Svelte vulnerabilities

Products

• Svelte 13
• Sveltekit 10
• Kit 5
• Devalue 4
• Adapter-node 2

Newest

• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.69.1 Prototype Pollution via File Input CVE-2026-82257 Fix available 5.3 MediumJuly 24, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.69.1 Denial of Service via Remote Form CVE-2026-82256 Fix available 6.9 MediumJuly 24, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch CVE-2026-82258 Fix available 5.9 MediumMay 21, 2026
• svelte, red hat build of podman desktop +1 more Svelte: XSS via DOM Clobbering of Internal Framework State CVE-2026-42573 Fix available 5.3 MediumMay 14, 2026
• svelte Svelte: ReDoS in `<svelte:element>` Tag Validation CVE-2026-42567 Fix available 5.9 MediumMay 14, 2026
• svelte devalue, red hat build of podman desktop, enterprise linux 10 +1 more +3 more Svelte devalue: DoS via sparse array deserialization CVE-2026-42570 Fix available 7.5 HighMay 14, 2026
• svelte Cross-site scripting via spread attributes in Svelte SSR CVE-2026-42599 Fix available 5.1 MediumMay 14, 2026
• svelte kit SvelteKit's invalidated redirect in handle hook causes Denial-of-Service CVE-2026-40074 Fix available 6.3 MediumApril 10, 2026
• svelte kit SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node CVE-2026-40073 Fix available 8.2 HighApril 10, 2026
• svelte devalue devalue has prototype pollution in devalue.parse and devalue.unflatten CVE-2026-30226 Fix available 6.3 MediumMarch 11, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit 2.49.0 before 2.53.3 Denial of Service via form CVE-2026-82259 Fix available 8.7 HighFebruary 28, 2026
• svelte Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers CVE-2026-27902 Fix available 5.3 MediumFebruary 26, 2026
• svelte Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` CVE-2026-27901 Fix available 5.3 MediumFebruary 26, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization CVE-2026-82261 Fix available 8.7 HighFebruary 19, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization CVE-2026-82260 Fix available 8.7 HighFebruary 19, 2026
• svelte Svelte SSR attribute spreading includes inherited properties from prototype chain CVE-2026-27125 Fix available 5.3 MediumFebruary 19, 2026
• svelte Svelte SSR does not validate dynamic element tag names in `<svelte:element>` CVE-2026-27122 Fix available 5.1 MediumFebruary 19, 2026
• svelte Svelte affected by cross-site scripting via spread attributes in Svelte SSR CVE-2026-27121 Fix available 5.1 MediumFebruary 19, 2026
• svelte Svelte affected by XSS in SSR `<option>` element CVE-2026-27119 Fix available 5.1 MediumFebruary 19, 2026
• svelte Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR) CVE-2025-15265 Fix available 5.3 MediumJanuary 15, 2026
• svelte devalue, red hat build of podman desktop - tech preview, trusted artifact signer 1.2 +1 more +3 more devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse CVE-2026-22775 Fix available 7.5 HighJanuary 15, 2026
• svelte kit SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer CVE-2026-22803 Fix available 8.2 HighJanuary 15, 2026
• svelte devalue, red hat build of podman desktop - tech preview, trusted artifact signer 1.2 +1 more +3 more devalue vulnerable to denial of service due to memory exhaustion in devalue.parse CVE-2026-22774 Fix available 7.5 HighJanuary 15, 2026
• svelte adapter-node, kit +1 more SvelteKit Denial of service and possible SSRF when using prerendering CVE-2025-67647 Fix available 8.4 HighJanuary 15, 2026
• svelte sveltekit, sveltejs kit +1 more Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit CVE-2024-53261 Fix available 2.0 LowNovember 25, 2024
• svelte sveltekit, sveltejs kit +1 more Unescaped error message included on error page in SvelteKit CVE-2024-53262 Fix available 2.0 LowNovember 25, 2024
• svelte Potential mXSS vulnerability due to improper HTML escaping in svelte CVE-2024-45047 Fix available 5.4 MediumAugust 30, 2024
• svelte adapter-node, kit +1 more Sending a GET or HEAD request with a body crashes SvelteKit CVE-2024-23641 Fix available 7.5 HighJanuary 24, 2024
• svelte sveltekit, sveltejs kit +1 more SvelteKit framework has Insufficient CSRF protection for CORS requests CVE-2023-29008 Fix available 8.8 HighApril 6, 2023
• svelte sveltekit, sveltejs kit +1 more SvelteKit has Insufficient Cross-Site Request Forgery Protection CVE-2023-29003 Fix available 8.8 HighApril 4, 2023
• svelte Cross-site Scripting (XSS) CVE-2022-25875 Fix available 5.4 MediumJuly 12, 2022
• svelte The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute... CVE-2021-29261 7.8 HighApril 5, 2021