TI-2026-30879 CVE-2026-42599 · GHSA-pr6f-5x2q-rwfp
Cross-site scripting via spread attributes in Svelte SSR
Priority LOW 23
Svelte is a performance oriented web framework.
Vulnerabilities
13 records
TI-2026-30847 CVE-2026-42567 · GHSA-9rmh-mm8f-r9h6
Svelte: ReDoS in `<svelte:element>` Tag Validation
Priority LOW 27
Svelte is a performance oriented web framework.
TI-2026-30853 CVE-2026-42573 · GHSA-rcqx-6q8c-2c42
Svelte: XSS via DOM Clobbering of Internal Framework State
Priority LOW 24
Svelte is a performance oriented web framework.
TI-2026-22246 CVE-2026-27902 · GHSA-qgvg-pr8v-6rr3
Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
Priority LOW 24
Svelte performance oriented web framework.
TI-2026-22245 CVE-2026-27901 · GHSA-phwv-c562-gvmh
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Priority LOW 24
Svelte performance oriented web framework.
TI-2026-21576 CVE-2026-27125 · GHSA-crpf-4hrx-3jrp
Svelte SSR attribute spreading includes inherited properties from prototype chain
Priority LOW 24
svelte performance oriented web framework.
TI-2026-21574 CVE-2026-27122 · GHSA-m56q-vw4c-c2cp
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
Priority LOW 23
svelte performance oriented web framework.
TI-2026-21573 CVE-2026-27121 · GHSA-f7gr-6p89-r883
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
Priority LOW 23
svelte performance oriented web framework.
TI-2026-21571 CVE-2026-27119 · GHSA-h7h7-mm68-gmrc
Svelte affected by XSS in SSR `<option>` element
Priority LOW 23
svelte performance oriented web framework.
TI-2025-13940 CVE-2025-15265 · GHSA-6738-r8g5-qwp3
Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)
Priority MEDIUM 57
An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable.
TI-2024-30159 CVE-2024-45047 · GHSA-8266-84wp-wv5c
Potential mXSS vulnerability due to improper HTML escaping in svelte
Priority MEDIUM 60
svelte performance oriented web framework.
TI-2022-09436 CVE-2022-25875 · GHSA-wv8q-r932-8hc7
Cross-site scripting (XSS) in svelte
Priority LOW 30
The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering).
TI-2021-10070 CVE-2021-29261 · GHSA-7hhg-cf2m-8xw7
The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to…
Priority LOW 37
The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration.