PT-2026-21307 · Svelte · Svelte

Elliott-With-The-Longest-Name-On-Github · CVE-2026-27125 · Published 2026-02-19 · Updated 2026-02-20

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Svelte versions prior to 5.51.5

Description Svelte is a performance-oriented web framework. In server-side rendering, attribute spreading on elements (e.g., <div {...attrs}>) enumerates inherited properties from the object's prototype chain instead of only own properties. If Object.prototype has been polluted—a condition outside of Svelte’s control—this can lead to unexpected attributes in the server-side rendering output or cause errors during server-side rendering. Client-side rendering is not affected.

Recommendations Update to version 5.51.5 or later.

Exploit

Fix

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-27125

GHSA-CRPF-4HRX-3JRP

Affected Products

Svelte

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27125.json · Exploit
• https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f · Patch
• https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27125 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27125 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crpf-4hrx-3jrp · Vendor Advisory
• https://github.com/sveltejs/svelte · Note
• https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5 · Note
• https://twitter.com/VulmonFeeds/status/2024991153594962137 · Twitter Post
• https://twitter.com/CVEnew/status/2024988712720011613 · Twitter Post