GitHub Advisoryadvisory · npm

GHSA-m56q-vw4c-c2cp Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

MEDIUM Published 2026-02-19 Modified 2026-02-23 Official page ↗
Aliases
CVE-2026-27122
Ecosystem
npm
Packages
svelte
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Weaknesses
CWE-79
Reviewed
2026-02-19

Affected packages

• npm svelte: < 5.51.5 → fixed in 5.51.5

Description

When using `` in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected.

Related

Alias · CVE (1)

  • CVE-2026-27122 svelte performance oriented web framework. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References