CVE-2026-27125 Svelte SSR attribute spreading includes inherited properties from prototype chain
Svelte SSR attribute spreading includes prototype chain properties, potentially causing errors or unexpected output if Object.prototype is polluted.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27125?
CVE-2026-27125 is a medium-severity vulnerability in sveltejs svelte, published on 20 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
Weakness: CWE-915
Which versions are affected by CVE-2026-27125?
2 open source packages ship an affected version, including svelte. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
svelte npm | All versions | 5.51.5 |
svelte npm | All versions | 5.51.5 |
Products include Svelte Svelte.
How do I fix CVE-2026-27125?
Upgrade svelte to 5.51.5 or later.
Is CVE-2026-27125 being exploited?
There is no known exploitation of CVE-2026-27125 in the wild and no public exploit code.
Other vulnerabilities in sveltejs svelte
- CVE-2021-29261 Code injection in n/a
- CVE-2026-42567 Svelte: ReDoS in `<svelte:element>` Tag Validation
- CVE-2024-45047 Potential mXSS vulnerability due to improper HTML escaping in svelte
- CVE-2022-25875 Cross-site Scripting (XSS)
- CVE-2026-42573 Svelte: XSS via DOM Clobbering of Internal Framework State
Sources
Also known as GHSA-crpf-4hrx-3jrp.