medium5.1
CVE-2026-27119
Svelte affected by XSS in SSR `<option>` element
Impact
In certain circumstances, the server-side rendering output of an `<option>` element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | svelte | >= 5.39.3, < 5.51.5 | 5.51.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Svelte | Svelte | from 5.39.3 before 5.51.5 |