Moderate severityNVD Advisory· Published Feb 20, 2026· Updated Feb 23, 2026
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
CVE-2026-27121
Description
svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. This vulnerability is fixed in 5.51.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sveltenpm | < 5.51.5 | 5.51.5 |
Affected products
5- osv-coords4 versionspkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/wolfi/langfuse-3-workerpkg:npm/svelte
< 3.163.0-r0+ 3 more
- (no CPE)range: < 3.163.0-r0
- (no CPE)range: < 3.163.0-r0
- (no CPE)range: < 3.163.0-r0
- (no CPE)range: < 5.51.5
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-f7gr-6p89-r883ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27121ghsaADVISORY
- github.com/sveltejs/svelte/security/advisories/GHSA-f7gr-6p89-r883ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.