CVE-2026-27902

CVE-2026-27902 · Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published: 2026-02-26T00:58:54.604Z
Updated: 2026-02-26T18:51:39.142Z

Stack: node

Affected products and versions

svelte
Versions
- >= 5.53.0, < 5.53.5: Affected
No fix published
svelte npm
Affected ranges
- SEMVER: ≥ 5.53.0, < 5.53.5
Update to 5.53.5

Original sources

https://github.com/sveltejs/svelte/security/advisories/GHSA-qgvg-pr8v-6rr3
https://github.com/sveltejs/svelte/commit/0298e979371bb583855c9810db79a70a551d22b9
https://github.com/sveltejs/svelte/releases/tag/svelte%405.53.5
https://nvd.nist.gov/vuln/detail/CVE-2026-27902

Check your server →

CVE-2026-27902 · Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

Affected products and versions

svelte

svelte npm

Original sources