CVE-2026-27902mediumCWE-79

CVE-2026-27902: medium-severity vulnerability in sveltejs svelte

Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

Published

Follow this CVE+ Monitor svelte+ Monitor svelte

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Affected products
sveltejs · svelte
Related CVEs — sveltejs svelte

In the same product, most dangerous first.

CVE-2026-42567MEDIUMSvelte: ReDoS in `<svelte:element>` Tag ValidationEPSS 0.5%CVE-2026-27125MEDIUMSvelte SSR attribute spreading includes inherited properties from prototype chainEPSS 0.4%CVE-2024-45047MEDIUMPotential mXSS vulnerability due to improper HTML escaping in svelteEPSS 0.4%CVE-2026-42573MEDIUMSvelte: XSS via DOM Clobbering of Internal Framework StateEPSS 0.3%CVE-2026-27901MEDIUMSvelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`EPSS 0.3%CVE-2026-27122MEDIUMSvelte SSR does not validate dynamic element tag names in `<svelte:element>`EPSS 0.2%