Vulnerability · Published Feb 20, 2026 · Assigned by GitHub_M

CVE-2026-27119Svelte affected by XSS in SSR `<option>` element

Medium 5.1

In plain English

A medium-severity cross-site scripting in svelte from sveltejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.2%top 88.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	svelte	5.51.5	GHSA-h7h7-mm68-gmrc

Affected products (as reported)

Vendor	Product	Versions
sveltejs	svelte	>= 5.39.3, < 5.51.5

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N

References

https://github.com/sveltejs/svelte/security/advisories/GHSA-h7h7-mm68-gmrc x_refsource_CONFIRM