Vulnerabilities in sveltejs

35 results
Vexday analysis

Sveltejs apresenta 26 vulnerabilidades conhecidas na base, nenhuma sob exploração ativa no momento. A ameaça dominante é cross-site scripting (CWE-79), com 4 novas publicações nos últimos 90 dias indicando descoberta contínua de falhas. Ausência de críticas CVSS sugere risco moderado, mas a recência das divulgações recomenda atenção a atualizações.

CVE-2026-27902MEDIUMSvelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration MarkersEPSS 0.4%CVE-2023-29008HIGHSvelteKit framework has Insufficient CSRF protection for CORS requestsEPSS 0.4%CVE-2026-27901MEDIUMSvelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`EPSS 0.4%CVE-2025-57820HIGHSvelte devalue vulnerable to prototype pollutionEPSS 0.4%CVE-2024-45047MEDIUMPotential mXSS vulnerability due to improper HTML escaping in svelteEPSS 0.4%CVE-2026-82257MEDIUMSvelteKit before 2.69.1 Prototype Pollution via File InputEPSS 0.4%CVE-2026-42573MEDIUMSvelte: XSS via DOM Clobbering of Internal Framework StateEPSS 0.3%CVE-2024-53261LOWCross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKitEPSS 0.3%CVE-2025-32388MEDIUMSvelteKit allows XSS via tracked search_paramsEPSS 0.3%CVE-2026-42599MEDIUMCross-site scripting via spread attributes in Svelte SSREPSS 0.2%CVE-2026-82258MEDIUMSvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batchEPSS 0.2%CVE-2026-27118MEDIUMCache poisoning in @sveltejs/adapter-vercelEPSS 0.2%CVE-2026-27122MEDIUMSvelte SSR does not validate dynamic element tag names in `<svelte:element>`EPSS 0.2%CVE-2026-27121MEDIUMSvelte affected by cross-site scripting via spread attributes in Svelte SSREPSS 0.2%CVE-2026-27119MEDIUMSvelte affected by XSS in SSR `<option>` elementEPSS 0.2%