CVE-2026-27901
1 advisory.
npm/svelte CVE-2026-27901: medium, EPSS 0.40%
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Action: Upgrade svelte to 5.53.5 or later.
npm i svelte@5.53.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.53.5 | - |
Fixed versions
| 5.53.5 |
Sources
- osv: GHSA-phwv-c562-gvmh
- https://github.com/sveltejs/svelte/security/advisories/GHSA-phwv-c562-gvmh
- https://nvd.nist.gov/vuln/detail/CVE-2026-27901
- https://github.com/sveltejs/svelte/commit/0df5abcae223058ceb95491470372065fb87951d
- https://github.com/sveltejs/svelte
- https://github.com/sveltejs/svelte/releases/tag/svelte@5.53.5
CVE-2026-27901 · published · modified · JSON