GCVE - cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Vendor	Svelte (`3cbea947-984c-58fb-b7e8-6d86eddc1f6a`)
Product	Svelte (`6f6b2691-e2e2-523b-9bf7-74f6b3a05ac1`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-27902`	vulnerable	2026-06-08 07:55:14.116628	Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue. Published: 2026-02-26T00:58:54.604Z Updated: 2026-02-26T18:51:39.142Z Open on db.gcve.eu Reference links https://github.com/sveltejs/svelte/security/advisories/GHSA-qgvg-pr8v-6rr3 https://github.com/sveltejs/svelte/commit/0298e979371bb583855c9810db79a70a551d22b9 https://github.com/sveltejs/svelte/releases/tag/svelte%405.53.5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-27901`	vulnerable	2026-06-08 07:55:14.114819	Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue. Published: 2026-02-26T00:57:40.269Z Updated: 2026-02-26T14:31:00.714Z Open on db.gcve.eu Reference links https://github.com/sveltejs/svelte/security/advisories/GHSA-phwv-c562-gvmh https://github.com/sveltejs/svelte/commit/0df5abcae223058ceb95491470372065fb87951d https://github.com/sveltejs/svelte/releases/tag/svelte%405.53.5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-27125`	vulnerable	2026-06-08 07:53:21.944672	Svelte SSR attribute spreading includes inherited properties from prototype chain svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5. Published: 2026-02-20T22:29:45.364Z Updated: 2026-02-25T21:33:14.822Z Open on db.gcve.eu Reference links https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-27122`	vulnerable	2026-06-08 07:53:21.942383	Svelte SSR does not validate dynamic element tag names in `<svelte:element>` svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5. Published: 2026-02-20T22:28:37.824Z Updated: 2026-02-23T19:23:03.403Z Open on db.gcve.eu Reference links https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-27121`	vulnerable	2026-06-08 07:53:21.941955	Svelte affected by cross-site scripting via spread attributes in Svelte SSR svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. This vulnerability is fixed in 5.51.5. Published: 2026-02-20T22:27:36.103Z Updated: 2026-02-23T19:34:18.150Z Open on db.gcve.eu Reference links https://github.com/sveltejs/svelte/security/advisories/GHSA-f7gr-6p89-r883	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-27119`	vulnerable	2026-06-08 07:53:21.938669	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-15265`	vulnerable	2026-06-08 07:06:35.968529	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-45047`	vulnerable	2026-06-08 06:45:54.456608	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25875`	vulnerable	2026-06-08 05:41:49.608186	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.