Sveltejs Svelte
10 CVEs affecting Sveltejs Svelte. Latest disclosed: 2026-06-09. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42567 | High | 7.5 | 2026-06-09 | Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time… |
CVE-2026-27125 | Medium | 6.8 | 2026-02-20 | svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inheri… |
CVE-2026-42599 | Medium | 6.1 | 2026-06-09 | Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler prope… |
CVE-2026-42573 | Medium | 6.1 | 2026-06-09 | Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, p… |
CVE-2026-27901 | Medium | 6.1 | 2026-02-26 | Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were… |
CVE-2026-27902 | Medium | 5.4 | 2026-02-26 | Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML… |
CVE-2026-27122 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not valid… |
CVE-2026-27121 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When u… |
CVE-2026-27119 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not pr… |
CVE-2024-45047 | Medium | 5.4 | 2024-08-30 | svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escap… |