VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Feb 20, 2026· Updated Jun 17, 2026

CVE-2026-27119

CVE-2026-27119

Description

svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
sveltenpm
>= 5.39.3, < 5.51.55.51.5

Affected products

3
  • Sveltejs/Svelte2 versions
    cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*range: >=5.39.3,<5.51.5
    • (no CPE)range: >= 5.39.3, < 5.51.5
  • ghsa-coords
    pkg:npm/svelte
    Range: >= 5.39.3, < 5.51.5

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.