HTML Injection Vulnerability in Svelte Framework by Svelte
CVE-2026-27122

5.1MEDIUM

Key Information:

Vendor

Sveltejs

Status
Svelte
Vendor
CVE Published:
20 February 2026

What is CVE-2026-27122?

The Svelte framework, a performance-oriented web framework, has a vulnerability in versions prior to 5.51.5. When utilizing the <svelte:element this={tag}> feature in server-side rendering, the framework fails to validate or sanitize the provided tag name. This oversight can lead to HTML injection if the tag string includes unexpected characters, compromising the integrity of the emitted HTML output. It's important to note that this vulnerability does not affect client-side rendering. Users are urged to update to version 5.51.5 or later to mitigate this risk. For more information, visit the official advisory at the Svelte GitHub page.

Affected Version(s)

svelte < 5.51.5

References

https://github.com/sveltejs/svelte/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.