Packages / svelte / Security

ModerateVulnerabilityGHSA-f7gr-6p89-r883CVE-2026-27121Published 19 Feb 2026

Svelte affected by cross-site scripting via spread attributes in Svelte SSR

Affected releases · svelte

  • 5.x5.0.0 – 5.51.4Fixed in 5.51.5
  • 4.x and older0.0.1 – 4.2.20No fix, no longer updated

On 5.x, the newest line:

npm install svelte@5.51.5
5.x

  1. Affected

    5.0.0 – 5.51.4

    300 releases

  2. Fixed

    5.51.5 – 5.57.2

    43 releases, latest

4.x

  1. Affected

    4.0.0 – 4.2.20

    30 releases

3.x

  1. Affected

    3.0.0 – 3.59.2

    152 releases

2.x

  1. Affected

    2.0.0 – 2.16.1

    57 releases

1.x

  1. Affected

    1.0.0 – 1.64.1

    178 releases

0.x

  1. Affected

    0.0.1 – 0.3.0

    8 releases

768 stable releases of svelte, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for svelte. It is read in your browser and sent nowhere.

What happens

Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers.