Product by Sveltejs
Svelte
10 known vulnerabilities in Svelte (Sveltejs), 0 of them actively exploited (CISA KEV).
Key figures
10
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-42567 | Svelte: ReDoS in `<svelte:element>` Tag Validation | 7.5 | |
| Medium | CVE-2026-27125 | Svelte SSR attribute spreading includes inherited properties from prototype chain | 6.8 | |
| Medium | CVE-2026-42573 | Svelte: XSS via DOM Clobbering of Internal Framework State | 6.1 | |
| Medium | CVE-2026-42599 | Cross-site scripting via spread attributes in Svelte SSR | 6.1 | |
| Medium | CVE-2026-27901 | Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` | 6.1 | |
| Medium | CVE-2026-27902 | Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers | 5.4 | |
| Medium | CVE-2026-27122 | Svelte SSR does not validate dynamic element tag names in `<svelte:element>` | 5.4 | |
| Medium | CVE-2026-27121 | Svelte affected by cross-site scripting via spread attributes in Svelte SSR | 5.4 | |
| Medium | CVE-2026-27119 | Svelte affected by XSS in SSR `<option>` element | 5.4 | |
| Medium | CVE-2024-45047 | Potential mXSS vulnerability due to improper HTML escaping in svelte | 5.4 |