Description
Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output.
Recommendation
Update the svelte package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.51.4
- Patched version(s): 5.51.5
References
Could your website be exposed too?
SmartScanner can check your website for Svelte affected by cross-site scripting via spread attributes in Svelte SSR and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Svelte SSR vulnerable to cross-site scripting via spread attributes - CVE-2026-42599
- CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
- repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard - CVE-2026-27612
- Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) - CVE-2026-23733
You might also like:
See something that needs correcting? Let us knowUpdated February 23, 2026