@budibase/server (>=3.32.1, <=3.38.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.6.6, <=2.1.0) +52 more potentially affected by CVE-2026-27121 via svelte (>=5.0.0, <=5.51.2)

svelte NPM version =5.0.0, =3.32.1, =0.6.6, =4.0.0-alpha.1, =4.0.0-alpha.1, =0.1.0, =0.0.1, =1.3.0, =0.1.4, =0.0.20, =0.15.0-beta.2, =1.1.0-beta.0, =5.0.0-next.80, =0.1.1-alpha.24, =0.1.3-next.2 and more Source cves: CVE-2026-27121 Source advisory: SNYK:JS-SVELTE-15322788...

Cross-site Scripting (XSS)

Overview org.webjars.npm:svelte is a package for building web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the spread syntax when rendering attributes from untrusted data during server-side rendering. An attacker can execute arbitrary JavaScript i...

@budibase/server (>=3.32.1, <=3.38.1), @burger-editor/client (>=4.0.0-alpha.26, <=4.0.0-alpha.61) +19 more potentially affected by CVE-2026-27119 via svelte (>=5.39.5, <=5.51.2)

svelte NPM version =5.39.5, =3.32.1, =4.0.0-alpha.26, =0.15.0-beta.2, =6.0.0, =2.4.0, =1.17.2, =0.1.2-alpha.1, =0.4.11, =0.0.3-next.1, =0.0.3-next.6 - dumbo-svelte 0.3.0 and more Source cves: CVE-2026-27119 Source advisory: SNYK:JS-SVELTE-15322810...

GHSA-H7H7-MM68-GMRC Svelte affected by XSS in SSR `<option>` element

In certain circumstances, the server-side rendering output of an element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected...

@budibase/server (>=3.32.1, <=3.38.1), @burger-editor/client (>=4.0.0-alpha.26, <=4.0.0-alpha.61) +19 more potentially affected by CVE-2026-27119 via svelte (>=5.39.5, <=5.51.2)

svelte NPM version =5.39.5, =3.32.1, =4.0.0-alpha.26, =0.15.0-beta.2, =6.0.0, =2.4.0, =1.17.2, =0.1.2-alpha.1, =0.4.11, =0.0.3-next.1, =0.0.3-next.6 - dumbo-svelte 0.3.0 and more Source cves: CVE-2026-27119 Source advisory: OSV:GHSA-H7H7-MM68-GMRC...

Cross-site Scripting (XSS)

Overview svelte is a package for building web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the server-side rendering process of the element, which does not properly escape its content. An attacker can inject arbitrary HTML into the SSR output by...

Svelte affected by XSS in SSR `<option>` element

In certain circumstances, the server-side rendering output of an element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected...

PT-2026-21305

Name of the Vulnerable Software and Affected Versions Svelte versions 5.39.3 through 5.51.4 Description Svelte is susceptible to a flaw where, under specific conditions, the server-side rendering of an element fails to properly escape its content. This can lead to potential HTML injection within...

PT-2026-20873

When using in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected...

PT-2026-20881

Name of the Vulnerable Software and Affected Versions Svelte versions prior to 5.51.5 Description A flaw exists in Svelte where, during server-side rendering, the tag name provided to the component is not validated or sanitized before being included in the HTML output. This can lead to HTML...

PT-2026-21306

Name of the Vulnerable Software and Affected Versions Svelte versions prior to 5.51.5 Description Svelte is susceptible to cross-site scripting XSS during server-side rendering. Utilizing spread syntax with untrusted data can lead to the inclusion of event handler properties in the generated HTML...

Malicious Package

Overview mapkit-example-svelte is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in mapkit-example-svelte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e50c0bfa7ac259128381d1495bc907b68e4721214789ed3316c0a57e387175 The package mapkit-example-svelte was found to contain malicious code. Source: ghsa-malware...

MAL-2026-523 Malicious code in mapkit-example-svelte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e50c0bfa7ac259128381d1495bc907b68e4721214789ed3316c0a57e387175 The package mapkit-example-svelte was found to contain malicious code. Source: ghsa-malware...

Denial Of Service (DoS)

Svelte devalue is vulnerable to a Denial-Of-Service DoS. The vulnerability is due to missing input validation during typed array hydration, where devalue.parse assumes an ArrayBuffer input without verification, allowing crafted inputs to trigger excessive CPU or memory consumption when parsing...

EUVD-2026-2911

svelte is vulnerable to XSS with textarea bind:value...

@alexanderniebuhr/eslint-config (>=1.3.0, <=1.4.0), @alexanderniebuhr/style (>=1.1.0, <=1.3.0) +173 more potentially affected by unknown CVE via svelte (>=3.1.0, <=3.59.1)

svelte NPM version =3.1.0, =1.3.0, =1.1.0, =1.3.0, =1.0.3, =0.0.999-alpha.30, =10.0.0, =7.1.4, =21.0.4, =8.0.4, =2.0.4, =1.0.1, =6.0.4, =12.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-GW32-9RMW-QWWW...

svelte is vulnerable to XSS with textarea bind:value

Summary A server-side rendered with two-way bound value does not have its value correctly escaped in the rendered HTML. Details In SSR, does not have its value escaped when it is rendered into the HTML as .... PoC Put this in a server-side-rendered Svelte component: let value = test'"alert'BIM';;...

@alexanderniebuhr/eslint-config (>=1.3.0, <=1.4.0), @alexanderniebuhr/style (>=1.1.0, <=1.3.0) +173 more potentially affected by unknown CVE via svelte (>=3.1.0, <=3.59.1)

svelte NPM version =3.1.0, =1.3.0, =1.1.0, =1.3.0, =1.0.3, =0.0.999-alpha.30, =10.0.0, =7.1.4, =21.0.4, =8.0.4, =2.0.4, =1.0.1, =6.0.4, =12.1.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-SVELTE-15032658...

Cross-site Scripting (XSS)

Overview svelte is a package for building web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the bind:value of server-side rendered elements when user-supplied content is not properly escaped. An attacker can execute arbitrary scripts in the context...