p PatchFirst

CVE-2026-27901

CVE-2026-27901 · Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • svelte

    Versions
    • < 5.53.5: Affected

    No fix published

  • svelte npm

    Affected ranges
    • SEMVER: < 5.53.5

    Update to 5.53.5

Original sources

Check your server →