VDB
CVE-2026-27901
CVE-2026-27901
PUBLISHED
CVSS 5.300000190734863 MEDIUM
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
EPSS 0.26% · 17.2th percentile
Risk Scores
CVSS 4.0
5.300000190734863
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS Score
0.26%
17.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| svelte | svelte | 0, 5.53.5, 0 |
| sveltejs | svelte | *, < 5.53.5, < 5.53.5 |
| npm | svelte | 0, 0, 0 |
Timeline
- Feb 26, 2026 CVE Published
- Feb 26, 2026 EPSS Score
- Feb 27, 2026 PoC Published
- Feb 28, 2026 EPSS Score
- Mar 2, 2026 EPSS Score
- Mar 5, 2026 EPSS Score
- Mar 7, 2026 EPSS Score
- Mar 9, 2026 EPSS Score
- Mar 10, 2026 Security Advisory
- Mar 11, 2026 EPSS Score
- Mar 13, 2026 EPSS Score
- Mar 16, 2026 EPSS Score
References
- https://github.com/sveltejs/svelte/commit/0df5abcae223058ceb95491470372065fb87951d fix
- https://github.com/sveltejs/svelte/releases/tag/svelte@5.53.5 fix
- https://github.com/sveltejs/svelte/releases/tag/svelte%405.53.5 fix
- https://github.com/sveltejs/svelte package
- https://github.com/sveltejs/svelte/security/advisories/GHSA-phwv-c562-gvmh advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27901 advisory