要点
- CVE-2026-27902 是影响 svelte (svelte), svelte 的中危 (CVSS 5.4)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.27%，高于 19.6% 的漏洞。
- 修复：升级到 5.53.5 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| svelte | ≥ 5.53.0, < 5.53.5
| 5.53.5
|
| svelte npm | ≥ 5.53.0, < 5.53.5
| 5.53.5
|
Description
Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError.
NVD description
Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free