CVE-2026-27901
CVE-2026-27901 · Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.
CVSS 5.3 · Media · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node