CVE-2026-27121 Svelte affected by cross-site scripting via spread attributes in Svelte SSR

Medium 5.1 Published 20 Feb 2026 Updated 23 Feb 2026

Attackers can inject malicious event handlers via spread attributes in Svelte SSR, leading to cross-site scripting in victims' browsers.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-27121?

CVE-2026-27121 is a medium-severity cross-site scripting vulnerability in sveltejs svelte, published on 20 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. This vulnerability is fixed in 5.51.5.

Weakness: CWE-79

Which versions are affected by CVE-2026-27121?

2 open source packages ship an affected version, including svelte. It affects 1 product.

Package	Affected	Fixed in
`svelte` npm	All versions	`5.51.5`
`svelte` npm	All versions	`5.51.5`

Products include Svelte Svelte.

How do I fix CVE-2026-27121?

Upgrade svelte to 5.51.5 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-27121 being exploited?

There is no known exploitation of CVE-2026-27121 in the wild and no public exploit code.

Sources

Also known as GHSA-f7gr-6p89-r883.