Every CVE Search/ Get API key

CVE-2026-27901

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

5.3 MediumFix available

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.26%Up 0.2 points since Feb 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.

Record
CVE-2026-27901
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-8799 5.3

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.

Record
EUVD-2026-8799
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-phwv-c562-gvmh 5.3

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

The contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server.

Record
GHSA-phwv-c562-gvmh
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.3

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.

Record
CVE-2026-27901
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.3

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.

Record
CVE-2026-27901
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-phwv-c562-gvmh 5.3

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

The contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server.

Record
GHSA-phwv-c562-gvmh
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-79
Updated
2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1775953999 No score

TuxCare security update for svelte (4 CVEs)

TuxCare rebuilt svelte to address 4 CVEs. Fixed in 4.2.20-tuxcare.1.

Record
CLSA-2026-1775953999
Updated
2026-11-02
OSVCLSA-2026-1776040402 No score

TuxCare security update for svelte (5 CVEs)

TuxCare rebuilt svelte to address 5 CVEs. Fixed in 3.59.2-tuxcare.1.

Record
CLSA-2026-1776040402
Updated
2026-11-02
OSVCLSA-2026-1776126838 No score

TuxCare security update for svelte (6 CVEs)

TuxCare rebuilt svelte to address 6 CVEs. Fixed in 2.16.1-tuxcare.1.

Record
CLSA-2026-1776126838
Updated
2026-11-02
OSVCLSA-2026-1776213244 No score

TuxCare security update for svelte (6 CVEs)

TuxCare rebuilt svelte to address 6 CVEs. Fixed in 1.64.1-tuxcare.1.

Record
CLSA-2026-1776213244
Updated
2026-11-02
OSVCLSA-2026-1776213252 No score

TuxCare security update for svelte (6 CVEs)

TuxCare rebuilt svelte to address 6 CVEs. Fixed in 0.3.0-tuxcare.1.

Record
CLSA-2026-1776213252
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
svelte
npm
 through 5.53.4
5.53.5
svelte
TuxCare:npm
From an advisory covering 4 CVEs
 4.2.20-tuxcare.0 up to 4.2.20-tuxcare.1, plus listed versions
4.2.20
4.2.20-tuxcare.1
svelte
TuxCare:npm
From an advisory covering 5 CVEs
 3.59.2-tuxcare.0 up to 3.59.2-tuxcare.1, plus listed versions
3.59.2
3.59.2-tuxcare.1
svelte
TuxCare:npm
From an advisory covering 6 CVEs
 2.16.1-tuxcare.0 up to 2.16.1-tuxcare.1, plus listed versions
2.16.1
2.16.1-tuxcare.1
svelte
TuxCare:npm
From an advisory covering 6 CVEs
 1.64.1-tuxcare.0 up to 1.64.1-tuxcare.1, plus listed versions
1.64.1
1.64.1-tuxcare.1
svelte
TuxCare:npm
From an advisory covering 6 CVEs
 0.3.0-tuxcare.0 up to 0.3.0-tuxcare.1, plus listed versions
0.3.0
0.3.0-tuxcare.1
svelte
npm
 before 5.53.5
5.53.5

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27901 is a medium vulnerability (CVSS 5.3) in Svelte, published February 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in svelte 5.53.5.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open