GitHub Advisoryadvisory · npm

GHSA-phwv-c562-gvmh Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

MEDIUM Published 2026-02-26 Modified 2026-02-26 Official page ↗
Aliases
CVE-2026-27901
Ecosystem
npm
Packages
svelte
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Weaknesses
CWE-79
Reviewed
2026-02-26

Affected packages

• npm svelte: < 5.53.5 → fixed in 5.53.5

Description

The contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server.

Related

Alias · CVE (1)

  • CVE-2026-27901 Svelte performance oriented web framework. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References