En bref
- CVE-2026-27902 est une vulnérabilité MOYENNE (CVSS 5.4) touchant svelte (svelte), svelte.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.27%, plus élevée que 19.6% des vulnérabilités.
- Correctif : mettre à jour vers 5.53.5 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| svelte | ≥ 5.53.0, < 5.53.5
| 5.53.5
|
| svelte npm | ≥ 5.53.0, < 5.53.5
| 5.53.5
|
Description
Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError.
NVD description
Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free