npm/svelte CVE-2026-27125: medium 6.8, EPSS 0.43%
Svelte SSR attribute spreading includes inherited properties from prototype chain
Action: Upgrade svelte to 5.51.5 or later.
npm i svelte@5.51.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.51.5 | - |
Fixed versions
| 5.51.5 |
Sources
- osv: GHSA-crpf-4hrx-3jrp
- nvd: CVE-2026-27125
- https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp
- https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f
- https://github.com/sveltejs/svelte
- https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5
CVE-2026-27125 · published · modified · JSON