CVE-2026-27901

UNKNOWN 0.0

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.

CWE	CWE-79
Vendor	sveltejs
Product	svelte
Published	Feb 26, 2026
Last Updated	Feb 26, 2026

Stay Ahead of the Next One

Get instant alerts for sveltejs svelte

Be the first to know when new unknown vulnerabilities affecting sveltejs svelte are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

sveltejs / svelte

< 5.53.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/sveltejs/svelte/security/advisories/GHSA-phwv-c562-gvmh github.com: https://github.com/sveltejs/svelte/commit/0df5abcae223058ceb95491470372065fb87951d github.com: https://github.com/sveltejs/svelte/releases/tag/svelte%405.53.5