Vulnerability Description
Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Svelte | Svelte | >= 5.53.0, < 5.53.5 |
Related Weaknesses (CWE)
References
- https://github.com/sveltejs/svelte/commit/0298e979371bb583855c9810db79a70a551d22Patch
- https://github.com/sveltejs/svelte/releases/tag/svelte%405.53.5Release Notes
- https://github.com/sveltejs/svelte/security/advisories/GHSA-qgvg-pr8v-6rr3Vendor Advisory
FAQ
What is CVE-2026-27902?
CVE-2026-27902 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection...
How severe is CVE-2026-27902?
CVE-2026-27902 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27902?
Check the references section above for vendor advisories and patch information. Affected products include: Svelte Svelte.