What’s Vulnerable › Vulnerabilities
CVE-2026-27122: Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-20 · updated 2026-06-17
- Weakness: CWE-79
Description
svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
Affected products
- sveltejs svelte: before 5.51.5 — fixed in 5.51.5
How to fix
Upgrade to a fixed version: sveltejs svelte 5.51.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-27122 or the next vulnerability affects your stack