Packages / svelte / Security

ModerateVulnerabilityGHSA-h7h7-mm68-gmrcCVE-2026-27119Published 19 Feb 2026

Svelte affected by XSS in SSR `<option>` element

Affected releases · svelte

  • 5.x5.39.3 – 5.51.4Fixed in 5.51.5

On 5.x, the newest line:

npm install svelte@5.51.5

  1. Not affected

    0.0.1 – 5.39.2

    649 releases

  2. Affected

    5.39.3 – 5.51.4

    76 releases

  3. Fixed

    5.51.5 – 5.57.2

    43 releases, latest

768 stable releases of svelte, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for svelte. It is read in your browser and sent nowhere.

What happens

In certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.