{"action":"Upgrade svelte to 5.55.7 or later.","affected":[{"fixed":"5.55.7","introduced":"0"}],"component":"svelte","cve_ids":["CVE-2026-42599"],"ecosystem":"npm","epss":0.00205,"exploited":false,"fixed_versions":["5.55.7"],"ghsa_id":"GHSA-pr6f-5x2q-rwfp","id":"tcs_01M5KG4B50F3MGDNQE05RHW83Q","modified_at":"2026-06-09T18:45:27.163431236Z","published_at":"2026-05-14T20:19:42Z","references":["https://osv.dev/vulnerability/GHSA-pr6f-5x2q-rwfp","https://github.com/sveltejs/svelte/security/advisories/GHSA-pr6f-5x2q-rwfp","https://nvd.nist.gov/vuln/detail/CVE-2026-27121","https://nvd.nist.gov/vuln/detail/CVE-2026-42599","https://github.com/sveltejs/svelte","https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-pr6f-5x2q-rwfp","url":"https://osv.dev/vulnerability/GHSA-pr6f-5x2q-rwfp"},{"source":"nvd","source_id":"CVE-2026-42599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42599"}],"summary":"Svelte SSR vulnerable to cross-site scripting via spread attributes"}