What’s Vulnerable › Vulnerabilities

CVE-2026-27125: Svelte SSR attribute spreading includes inherited properties from prototype chain

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-20 · updated 2026-06-17
• Weakness: CWE-915

Description

svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.

Affected products

• sveltejs svelte: before 5.51.5 — fixed in 5.51.5

How to fix

Upgrade to a fixed version: sveltejs svelte 5.51.5. Check the vendor advisory for mitigations.

References

• https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f
• https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5
• https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp

Get alerted when CVE-2026-27125 or the next vulnerability affects your stack