CVE-2026-27902: Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-26 · updated 2026-06-17
Weakness: CWE-79

Description

Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.

Affected products

sveltejs svelte: from 5.53.0 before 5.53.5 — fixed in 5.53.5

How to fix

Upgrade to a fixed version: sveltejs svelte 5.53.5. Check the vendor advisory for mitigations.

References

https://github.com/sveltejs/svelte/commit/0298e979371bb583855c9810db79a70a551d22b9
https://github.com/sveltejs/svelte/releases/tag/svelte%405.53.5
https://github.com/sveltejs/svelte/security/advisories/GHSA-qgvg-pr8v-6rr3

Get alerted when CVE-2026-27902 or the next vulnerability affects your stack