Skip to main content
cve.nowby Sazabi
← npm
npmPackage

svelte

12 known vulnerabilities (12 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 12 medium
Registry
npm

Advisories 12

  • CVE-2026-42599Medium 5.1

    Cross-site scripting via spread attributes in Svelte SSR

    Affected: fixed in 5.55.7.

  • CVE-2026-42567Medium 5.9

    Svelte: ReDoS in `<svelte:element>` Tag Validation

    Affected: from 5.51.5, fixed in 5.55.7.

  • CVE-2026-42573Medium 5.3

    Svelte: XSS via DOM Clobbering of Internal Framework State

    Affected: fixed in 5.55.7.

  • CVE-2026-27902Medium 5.3

    Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

    Affected: from 5.53.0, fixed in 5.53.5.

  • CVE-2026-27901Medium 5.3

    Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

    Affected: fixed in 5.53.5.

  • CVE-2026-27125Medium 5.3

    Svelte SSR attribute spreading includes inherited properties from prototype chain

    Affected: fixed in 5.51.5.

  • CVE-2026-27122Medium 5.1

    Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

    Affected: fixed in 5.51.5.

  • CVE-2026-27121Medium 5.1

    Svelte affected by cross-site scripting via spread attributes in Svelte SSR

    Affected: fixed in 5.51.5.

  • CVE-2026-27119Medium 5.1

    Svelte affected by XSS in SSR `<option>` element

    Affected: from 5.39.3, fixed in 5.51.5.

  • CVE-2025-15265Medium 5.3

    Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)

    Affected: from 5.46.0, fixed in 5.46.3; from 5.46.0, fixed in 5.46.4.

  • CVE-2024-45047Medium 5.4

    Potential mXSS vulnerability due to improper HTML escaping in svelte

    Affected: fixed in 4.2.19.

  • CVE-2022-25875Medium 5.4

    Cross-site Scripting (XSS)

    Affected: fixed in 3.49.0.