npm package
svelte
pkg:npm/svelte
Vulnerabilities (12)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-42573 | — | < 5.55.7 | 5.55.7 | May 14, 2026 | Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. You are vulnerable if all of the following is true: - you are using attribute spreading on a form element - you are using attribute spreading or allow a dynam | ||
| CVE-2026-42567 | — | >= 5.51.5, < 5.55.7 | 5.55.7 | May 14, 2026 | An internal regex in the Svelte runtime can take exponential time to test in `<svelte:element this={tag}></svelte:element>`. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their leng | ||
| CVE-2026-42599 | — | < 5.55.7 | 5.55.7 | May 14, 2026 | When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in | ||
| CVE-2026-27902 | — | >= 5.53.0, < 5.53.5 | 5.53.5 | Feb 26, 2026 | Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Versi | ||
| CVE-2026-27901 | — | < 5.53.5 | 5.53.5 | Feb 26, 2026 | Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the | ||
| CVE-2026-27125 | — | < 5.51.5 | 5.51.5 | Feb 20, 2026 | svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. ) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype | ||
| CVE-2026-27122 | — | < 5.51.5 | 5.51.5 | Feb 20, 2026 | svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can res | ||
| CVE-2026-27121 | — | < 5.51.5 | 5.51.5 | Feb 20, 2026 | svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML o | ||
| CVE-2026-27119 | — | >= 5.39.3, < 5.51.5 | 5.51.5 | Feb 20, 2026 | svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. | ||
| CVE-2025-15265 | — | >= 5.46.0, < 5.46.4 | 5.46.4 | Jan 15, 2026 | An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a to terminate the script and inject arbitrary JavaScript. This enables remote script execution in | ||
| CVE-2024-45047 | — | < 4.2.19 | 4.2.19 | Aug 30, 2024 | svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the f | ||
| CVE-2022-25875 | — | < 3.49.0 | 3.49.0 | Jul 12, 2022 | The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toStrin |
- CVE-2026-42573May 14, 2026affected < 5.55.7fixed 5.55.7
Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. You are vulnerable if all of the following is true: - you are using attribute spreading on a form element - you are using attribute spreading or allow a dynam
- CVE-2026-42567May 14, 2026affected >= 5.51.5, < 5.55.7fixed 5.55.7
An internal regex in the Svelte runtime can take exponential time to test in `<svelte:element this={tag}></svelte:element>`. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their leng
- CVE-2026-42599May 14, 2026affected < 5.55.7fixed 5.55.7
When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in
- CVE-2026-27902Feb 26, 2026affected >= 5.53.0, < 5.53.5fixed 5.53.5
Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Versi
- CVE-2026-27901Feb 26, 2026affected < 5.53.5fixed 5.53.5
Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the
- CVE-2026-27125Feb 20, 2026affected < 5.51.5fixed 5.51.5
svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. ) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype
- CVE-2026-27122Feb 20, 2026affected < 5.51.5fixed 5.51.5
svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can res
- CVE-2026-27121Feb 20, 2026affected < 5.51.5fixed 5.51.5
svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML o
- CVE-2026-27119Feb 20, 2026affected >= 5.39.3, < 5.51.5fixed 5.51.5
svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.
- CVE-2025-15265Jan 15, 2026affected >= 5.46.0, < 5.46.4fixed 5.46.4
An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a to terminate the script and inject arbitrary JavaScript. This enables remote script execution in
- CVE-2024-45047Aug 30, 2024affected < 4.2.19fixed 4.2.19
svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the f
- CVE-2022-25875Jul 12, 2022affected < 3.49.0fixed 3.49.0
The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toStrin