SV
Product
Svelte
13
CVEs
0
On KEV
7.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 11Low 0
Watch
Add Svelte to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-27125 | 6.8 | Feb 20 | Svelte SSR attribute spreading includes inherited properties from prototype chain Affected: before 5.51.5 |
| CVE-2026-42599 | 6.1 | Jun 9 | Cross-site scripting via spread attributes in Svelte SSR Affected: before 5.55.7 |
| CVE-2026-42573 | 6.1 | Jun 9 | Svelte: XSS via DOM Clobbering of Internal Framework State Affected: before 5.55.7 |
| CVE-2026-27901 | 6.1 | Feb 26 | Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` Affected: before 5.53.5; 5.53.5 |
| CVE-2025-15265 | 6.1 | Jan 15 | Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR) Affected: 5.46.0 before 5.46.3 |
| CVE-2024-45047 | 6.1 | Aug 30 | svelte performance oriented web framework Affected: before 4.2.19 |
| CVE-2022-25875 | 6.1 | Jul 12 | The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR… Affected: before 3.49.0 |
| CVE-2026-27902 | 5.4 | Feb 26 | Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers Affected: 5.53.0 before 5.53.5 |
| CVE-2026-27122 | 5.4 | Feb 20 | Svelte SSR does not validate dynamic element tag names in `<svelte:element>` Affected: before 5.51.5 |
| CVE-2026-27121 | 5.4 | Feb 20 | Svelte affected by cross-site scripting via spread attributes in Svelte SSR Affected: before 5.51.5 |
| CVE-2026-27119 | 5.4 | Feb 20 | Svelte affected by XSS in SSR `<option>` element Affected: 5.39.3 before 5.51.5 |
Showing 11