Skip to content
Sign in
5.3 Medium

CVE-2026-27901 Svelte performance oriented web framework

Description

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.

Affected products and versions

Product Affected versions Fixed in
svelte 5.53 earliest → < 5.53.5 5.53.5

Other CVEs of svelte

The 10 CVEs of svelte →
CVE-2026-42599 Svelte is a performance oriented web framework 5.1 Medium CVE-2026-42567 Svelte is a performance oriented web framework 5.9 Medium CVE-2026-42573 Svelte is a performance oriented web framework 5.3 Medium CVE-2026-27902 Svelte performance oriented web framework 5.3 Medium
Track this CVE