CVE-2026-27902

Опубликовано: 26 фев. 2026

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

Svelte performance oriented web framework. Prior to version 5.53.5, errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError. Version 5.53.5 fixes the issue.

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*

Версия от 5.53.0 (включая) до 5.53.5 (исключая)

EPSS

Процентиль: 9%

0.00032

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

CVE-2026-27902

CVSS3: 4.2

redhat

30 дней назад

Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.

GHSA-qgvg-pr8v-6rr3

github

29 дней назад

Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers