CVE-2026-27119

svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/sveltejs/svelte/security/advisories/GHSA-h7h7-mm68-gmrc	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*

History

17 Jun 2026, 10:26

Type	Values Removed	Values Added
Summary		(es) framework web svelte orientado al rendimiento. Desde 5.39.3, <=5.51.4, en ciertas circunstancias, la salida de renderizado del lado del servidor de un elemento no escapa correctamente su contenido, lo que podría permitir la inyección de HTML en la salida SSR. El renderizado del lado del cliente no se ve afectado. Esta vulnerabilidad se ha corregido en 5.51.5.

23 Feb 2026, 20:54

Type	Values Removed	Values Added
First Time		Svelte svelte Svelte
References	~~() https://github.com/sveltejs/svelte/security/advisories/GHSA-h7h7-mm68-gmrc -~~	() https://github.com/sveltejs/svelte/security/advisories/GHSA-h7h7-mm68-gmrc - Vendor Advisory
CPE		cpe:2.3:a:svelte:svelte::::::node.js::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4

20 Feb 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-20 23:16

Updated : 2026-06-17 10:26

NVD link : CVE-2026-27119

Mitre link : CVE-2026-27119

CVE.ORG link : CVE-2026-27119

JSON object : View

Products Affected

svelte

svelte

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-27119", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27119", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T19:41:15.323949Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sveltejs", "product": "svelte", "versions": [{"status": "affected", "version": ">= 5.39.3, < 5.51.5"}]}]}], "published": "2026-02-20T23:16:02.360", "references": [{"url": "https://github.com/sveltejs/svelte/security/advisories/GHSA-h7h7-mm68-gmrc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5."}, {"lang": "es", "value": "framework web svelte orientado al rendimiento. Desde 5.39.3, <=5.51.4, en ciertas circunstancias, la salida de renderizado del lado del servidor de un elemento no escapa correctamente su contenido, lo que podr\u00eda permitir la inyecci\u00f3n de HTML en la salida SSR. El renderizado del lado del cliente no se ve afectado. Esta vulnerabilidad se ha corregido en 5.51.5."}], "lastModified": "2026-06-17T10:26:42.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "03E3566B-7270-49AE-8C2E-4F39941F3D8A", "versionEndExcluding": "5.51.5", "versionStartIncluding": "5.39.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}