CVE-2026-27901 MEDIUM

CVE-2026-27901: Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

Vendor Sveltejs
Product svelte
Weakness CWE-79 · XSS
Published February 26, 2026
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N

What the vulnerability does

01Description

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.

Key dates

02Disclosure timeline

February 26, 2026 CVE published
February 26, 2026 Record updated