Sveltejs vulnerabilities
48 CVEs and advisories name Sveltejs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-27901Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
- CVE-2026-27125Svelte SSR attribute spreading includes inherited properties from prototype chain
- CVE-2026-27122Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
- CVE-2026-27121Svelte affected by cross-site scripting via spread attributes in Svelte SSR
- CVE-2026-27119Svelte affected by XSS in SSR `<option>` element
- CVE-2026-27118Cache poisoning in @sveltejs/adapter-vercel
- CVE-2026-22775devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
- CVE-2026-22774devalue vulnerable to denial of service due to memory exhaustion in devalue.parse
- CVE-2026-22803SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer
- CVE-2025-67647SvelteKit Denial of service and possible SSRF when using prerendering
- CVE-2025-57820Svelte devalue vulnerable to prototype pollution
- CVE-2025-32388SvelteKit allows XSS via tracked search_params
- CVE-2024-53261Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit
- CVE-2024-53262Unescaped error message included on error page in SvelteKit
- CVE-2024-45047Potential mXSS vulnerability due to improper HTML escaping in svelte
- CVE-2024-23641Sending a GET or HEAD request with a body crashes SvelteKit
- CVE-2023-29008SvelteKit framework has Insufficient CSRF protection for CORS requests
- CVE-2023-29003SvelteKit has Insufficient Cross-Site Request Forgery Protection