Packages / svelte / Security

ModerateVulnerabilityGHSA-phwv-c562-gvmhCVE-2026-27901Published 26 Feb 2026

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

Affected releases · svelte

  • 5.x5.0.0 – 5.53.4Fixed in 5.53.5
  • 4.x and older0.0.1 – 4.2.20No fix, no longer updated

On 5.x, the newest line:

npm install svelte@5.53.5
5.x

  1. Affected

    5.0.0 – 5.53.4

    307 releases

  2. Fixed

    5.53.5 – 5.57.2

    36 releases, latest

4.x

  1. Affected

    4.0.0 – 4.2.20

    30 releases

3.x

  1. Affected

    3.0.0 – 3.59.2

    152 releases

2.x

  1. Affected

    2.0.0 – 2.16.1

    57 releases

1.x

  1. Affected

    1.0.0 – 1.64.1

    178 releases

0.x

  1. Affected

    0.0.1 – 0.3.0

    8 releases

768 stable releases of svelte, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for svelte. It is read in your browser and sent nowhere.

What happens

The contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server.