MEDIUMnpm
GHSA-6738-r8g5-qwp3· CVE-2025-15265svelte vulnerable to Cross-site Scripting
Modified: 2/3/2026
package
npm/svelte
pkg:npm/svelte
MEDIUM5.4npm
GHSA-8266-84wp-wv5c· CVE-2024-45047Svelte has a potential mXSS vulnerability due to improper HTML escaping
Modified: 8/30/2024
MEDIUMnpm
GHSA-9rmh-mm8f-r9h6· CVE-2026-42567Svelte: ReDoS in `<svelte:element>` Tag Validation
Modified: 6/9/2026
MEDIUMnpm
GHSA-crpf-4hrx-3jrp· CVE-2026-27125Svelte SSR attribute spreading includes inherited properties from prototype chain
Modified: 9/10/2026
MEDIUMnpm
GHSA-f3cj-j4f6-wq85Svelte: SSR XSS via Insecure Promise Serialization in hydratable
Modified: 5/14/2026
MEDIUMnpm
GHSA-f7gr-6p89-r883· CVE-2026-27121Svelte affected by cross-site scripting via spread attributes in Svelte SSR
Modified: 9/10/2026
HIGHnpm
GHSA-gw32-9rmw-qwwwsvelte is vulnerable to XSS with textarea bind:value
Modified: 2/3/2026
MEDIUMnpm
GHSA-h7h7-mm68-gmrc· CVE-2026-27119Svelte affected by XSS in SSR `<option>` element
Modified: 2/23/2026
MEDIUMnpm
GHSA-m56q-vw4c-c2cp· CVE-2026-27122Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
Modified: 9/10/2026
MEDIUMnpm
GHSA-phwv-c562-gvmh· CVE-2026-27901Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Modified: 9/10/2026
MEDIUMnpm
GHSA-pr6f-5x2q-rwfp· CVE-2026-42599Svelte SSR vulnerable to cross-site scripting via spread attributes
Modified: 6/9/2026
MEDIUMnpm
GHSA-qgvg-pr8v-6rr3· CVE-2026-27902Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
Modified: 2/26/2026
MEDIUMnpm
GHSA-rcqx-6q8c-2c42· CVE-2026-42573Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
Modified: 6/9/2026
MEDIUM6.1npm
GHSA-wv8q-r932-8hc7· CVE-2022-25875, SNYK-JS-SVELTE-2931080Svelte vulnerable to XSS when using objects during server-side rendering
Modified: 7/8/2026