Kurz gesagt
- CVE-2026-27902 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in svelte (svelte), svelte.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.27%, höher als bei 19.6% aller Schwachstellen.
- Abhilfe: auf 5.53.5 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| svelte | ≥ 5.53.0, < 5.53.5
| 5.53.5
|
| svelte npm | ≥ 5.53.0, < 5.53.5
| 5.53.5
|
Description
Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError.
NVD description
Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free