PT-2026-20873 · Npm · Svelte

Publicado 2026-02-19 · Atualizado 2026-02-19

OSV

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N

When using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

GHSA-M56Q-VW4C-C2CP

Produtos afetados

Svelte

Referências · 4

• https://github.com/sveltejs/svelte · Nota
• https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27122 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-m56q-vw4c-c2cp · Aviso do Fabricante