En resumen
- CVE-2026-27902 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a svelte (svelte), svelte.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.27%, mayor que el 19.6% de las vulnerabilidades.
- Solución: actualizar a 5.53.5 o posterior.
| Package | Affected versions | Patched versions |
|---|
| svelte | ≥ 5.53.0, < 5.53.5
| 5.53.5
|
| svelte npm | ≥ 5.53.0, < 5.53.5
| 5.53.5
|
Description
Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError.
NVD description
Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free