CVE-2026-27119
svelte performance oriented web framework.
Published Feb 20, 2026 · updated Jun 17, 2026 · svelte svelte
svelte performance oriented web framework. From 5.39.3, element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 20, 2026 · NIST NVD
Detected
svelte performance oriented web framework. From 5.39.3, element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
Jun 17, 2026 · NIST NVD
Updated
svelte performance oriented web framework. From 5.39.3, element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
Affected
- cpe svelte/svelteversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-27119
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-27119
svelte performance oriented web framework. From 5.39.3, element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.
nvd.nist.gov