sveltejs

Records51All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high22CVSS 7.0–8.9

Exploited now

sveltejs records in CISA KEV

No sveltejs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Svelte 13 records MEDIUM Sveltekit 10 records HIGH Kit 5 records HIGH Devalue 4 records MEDIUM Adapter-node 2 records HIGH

Records

13 records in Svelte · all components

TI-2024-30159 CVE-2024-45047 · GHSA-8266-84wp-wv5c

Potential mXSS vulnerability due to improper HTML escaping in svelte

MEDIUM 60

svelte performance oriented web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00365 Published 2024-08-30 Fixed in 4.2.19 CWE-79

TI-2025-13940 CVE-2025-15265 · GHSA-6738-r8g5-qwp3

Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)

MEDIUM 57

An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00346 Published 2026-01-15 Partial fix · 5.46.3, 5.46.4 CWE-79

TI-2021-10070 CVE-2021-29261 · GHSA-7hhg-cf2m-8xw7

The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to…

LOW 37

The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01374 Published 2021-04-05 No fix listed

TI-2022-09436 CVE-2022-25875 · GHSA-wv8q-r932-8hc7

Cross-site scripting (XSS) in svelte

LOW 30

The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01441 Published 2022-07-12 Fixed in 3.49.0 CWE-79

TI-2026-30847 CVE-2026-42567 · GHSA-9rmh-mm8f-r9h6

Svelte: ReDoS in `<svelte:element>` Tag Validation

LOW 27

Svelte is a performance oriented web framework.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00451 Published 2026-06-09 Partial fix · 5.55.7 CWE-1333

TI-2026-30853 CVE-2026-42573 · GHSA-rcqx-6q8c-2c42

Svelte: XSS via DOM Clobbering of Internal Framework State

LOW 24

Svelte is a performance oriented web framework.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-06-09 Fixed in 5.55.7 CWE-79

TI-2026-22246 CVE-2026-27902 · GHSA-qgvg-pr8v-6rr3

Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

LOW 24

Svelte performance oriented web framework.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00272 Published 2026-02-26 Partial fix · 5.53.5 CWE-79

TI-2026-22245 CVE-2026-27901 · GHSA-phwv-c562-gvmh

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

LOW 24

Svelte performance oriented web framework.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00257 Published 2026-02-26 Partial fix · 5.53.5 CWE-79

TI-2026-21576 CVE-2026-27125 · GHSA-crpf-4hrx-3jrp

Svelte SSR attribute spreading includes inherited properties from prototype chain

LOW 24

svelte performance oriented web framework.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00434 Published 2026-02-20 Partial fix · 5.51.5 CWE-915

TI-2026-30879 CVE-2026-42599 · GHSA-pr6f-5x2q-rwfp

Cross-site scripting via spread attributes in Svelte SSR

LOW 23

Svelte is a performance oriented web framework.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00205 Published 2026-06-09 Partial fix · 5.55.7 CWE-79

TI-2026-21574 CVE-2026-27122 · GHSA-m56q-vw4c-c2cp

Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

LOW 23

svelte performance oriented web framework.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.0022 Published 2026-02-20 Partial fix · 5.51.5 CWE-79

TI-2026-21573 CVE-2026-27121 · GHSA-f7gr-6p89-r883

Svelte affected by cross-site scripting via spread attributes in Svelte SSR

LOW 23

svelte performance oriented web framework.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.0022 Published 2026-02-20 Partial fix · 5.51.5 CWE-79

TI-2026-21571 CVE-2026-27119 · GHSA-h7h7-mm68-gmrc

Svelte affected by XSS in SSR `<option>` element

LOW 23

svelte performance oriented web framework.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00211 Published 2026-02-20 Partial fix · 5.51.5 CWE-79

Open these records in search →