Vulnerability · Published Feb 20, 2026 · Assigned by GitHub_M

CVE-2026-27122Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

Medium 5.1

In plain English

A medium-severity cross-site scripting in svelte from sveltejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.2%top 87.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	svelte	5.51.5	GHSA-m56q-vw4c-c2cp

Affected products (as reported)

Vendor	Product	Versions
sveltejs	svelte	< 5.51.5

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N

References

https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp x_refsource_CONFIRM