Packages / svelte / Security

ModerateVulnerabilityGHSA-qgvg-pr8v-6rr3CVE-2026-27902Published 26 Feb 2026

Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

Affected releases · svelte

  • 5.x5.53.0 – 5.53.4Fixed in 5.53.5

On 5.x, the newest line:

npm install svelte@5.53.5

  1. Not affected

    0.0.1 – 5.52.0

    727 releases

  2. Affected

    5.53.0 – 5.53.4

    5 releases

  3. Fixed

    5.53.5 – 5.57.2

    36 releases, latest

768 stable releases of svelte, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for svelte. It is read in your browser and sent nowhere.

What happens

Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError.