PT-2026-22076 · Svelte · Svelte

Elliott-With-The-Longest-Name-On-Github · Published 2026-02-26 · Updated 2026-03-05 · CVE-2026-27901

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Svelte versions prior to 5.53.5

Description Svelte, a performance-oriented web framework, had an issue where the contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped in versions prior to 5.53.5. This could allow for HTML injection and Cross-Site Scripting (XSS) if untrusted data is rendered as the initial value of the binding on the server. The vulnerable parameters are innerText and textContent.

Recommendations Update to Svelte version 5.53.5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27901

GHSA-PHWV-C562-GVMH

Affected Products

Svelte

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27901.json · Exploit
• https://github.com/sveltejs/svelte/commit/0df5abcae223058ceb95491470372065fb87951d · Patch
• https://github.com/sveltejs/svelte/security/advisories/GHSA-phwv-c562-gvmh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-phwv-c562-gvmh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27901 · Security Note
• https://github.com/sveltejs/svelte · Note
• https://github.com/sveltejs/svelte/releases/tag/svelte%405.53.5 · Note
• https://github.com/sveltejs/svelte/releases/tag/svelte@5.53.5 · Note
• https://twitter.com/VulmonFeeds/status/2026998582063091800 · Twitter Post
• https://t.me/cveNotify/154328 · Telegram Post
• https://twitter.com/CVEnew/status/2027004232017088942 · Twitter Post
• https://twitter.com/_cvereports/status/2027234818417655919 · Twitter Post