CVE-2026-27119mediumCWE-79

CVE-2026-27119: falha de média gravidade em sveltejs svelte

Svelte affected by XSS in SSR `<option>` element

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar svelte+ Monitorar svelte

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.2%
svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Produtos afetados
sveltejs · svelte
CVEs relacionadas — sveltejs svelte

No mesmo produto, das mais perigosas para as menos.

CVE-2026-42567MEDIUMSvelte: ReDoS in `<svelte:element>` Tag ValidationEPSS 0.5%CVE-2026-27125MEDIUMSvelte SSR attribute spreading includes inherited properties from prototype chainEPSS 0.4%CVE-2024-45047MEDIUMPotential mXSS vulnerability due to improper HTML escaping in svelteEPSS 0.4%CVE-2026-42573MEDIUMSvelte: XSS via DOM Clobbering of Internal Framework StateEPSS 0.3%CVE-2026-27902MEDIUMSvelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration MarkersEPSS 0.3%CVE-2026-27901MEDIUMSvelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`EPSS 0.3%