Medium severity6.1NVD Advisory· Published Feb 26, 2026· Updated Jun 17, 2026
CVE-2026-27901
CVE-2026-27901
Description
Svelte performance oriented web framework. Prior to version 5.53.5, the contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sveltenpm | < 5.53.5 | 5.53.5 |
Affected products
7- osv-coords4 versionspkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/wolfi/langfuse-3-workerpkg:npm/svelte
< 3.163.0-r0+ 3 more
- (no CPE)range: < 3.163.0-r0
- (no CPE)range: < 3.163.0-r0
- (no CPE)range: < 3.163.0-r0
- (no CPE)range: < 5.53.5
Patches
Vulnerability mechanics
References
6- github.com/sveltejs/svelte/commit/0df5abcae223058ceb95491470372065fb87951dnvdPatchWEB
- github.com/advisories/GHSA-phwv-c562-gvmhghsaADVISORY
- github.com/sveltejs/svelte/security/advisories/GHSA-phwv-c562-gvmhnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-27901ghsaADVISORY
- github.com/sveltejs/svelte/releases/tag/svelte%405.53.5nvdRelease Notes
- github.com/sveltejs/svelte/releases/tag/[email protected]ghsaWEB
News mentions
0No linked articles in our index yet.