Svelte performance oriented web framework.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 26, 2026 · NIST NVD

   Detected

   Svelte performance oriented web framework. Prior to version 5.53.5, errors from were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from . Version 5.53.5 fixes the issue.

2. Jun 17, 2026 · NIST NVD

   Updated

   Svelte performance oriented web framework. Prior to version 5.53.5, errors from were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from . Version 5.53.5 fixes the issue.

Affected

• cpe svelte/svelteversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-27902

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27902

  Svelte performance oriented web framework. Prior to version 5.53.5, errors from were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from . Versi

  nvd.nist.gov

References

• Patch · github.com
• Release Notes · github.com
• Vendor Advisory · github.com