Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

Mô tả

Tham khảo

• sveltejs/svelte security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2026-27902 · ADVISORY
• sveltejs/svelte commit 0298e97 · WEB
• sveltejs/svelte · PACKAGE
• sveltejs/svelte release [email protected] · WEB
• sveltejs/svelte release [email protected] · Release Notes

Lỗ hổng khác của svelte

• CVE-2026-42599TRUNG BÌNH 6.1Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, …
• CVE-2026-42573TRUNG BÌNH 6.1Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework s…
• CVE-2026-42567CAO 7.5Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can ta…
• CVE-2026-27901TRUNG BÌNH 6.1Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contentedita…
• CVE-2026-27125TRUNG BÌNH 6.8svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>…