{"action":"Upgrade svelte to 5.53.5 or later.","affected":[{"fixed":"5.53.5","introduced":"5.53.0"}],"component":"svelte","cve_ids":["CVE-2026-27902"],"ecosystem":"npm","epss":0.00272,"exploited":false,"fixed_versions":["5.53.5"],"ghsa_id":"GHSA-qgvg-pr8v-6rr3","id":"tcs_01M5KG649Z32VPSJ7BR0J9GDGZ","modified_at":"2026-02-26T22:37:20.605129Z","published_at":"2026-02-26T22:25:45Z","references":["https://osv.dev/vulnerability/GHSA-qgvg-pr8v-6rr3","https://github.com/sveltejs/svelte/security/advisories/GHSA-qgvg-pr8v-6rr3","https://nvd.nist.gov/vuln/detail/CVE-2026-27902","https://github.com/sveltejs/svelte/commit/0298e979371bb583855c9810db79a70a551d22b9","https://github.com/sveltejs/svelte","https://github.com/sveltejs/svelte/releases/tag/svelte@5.53.5"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-qgvg-pr8v-6rr3","url":"https://osv.dev/vulnerability/GHSA-qgvg-pr8v-6rr3"},{"source":"nvd","source_id":"CVE-2026-27902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27902"}],"summary":"Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers"}