Description
Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output.
Recommendation
Update the svelte package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.51.4
- Patched version(s): 5.51.5
References
Could your website be exposed too?
SmartScanner can check your website for Svelte affected by cross-site scripting via spread attributes in Svelte SSR and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Svelte SSR vulnerable to cross-site scripting via spread attributes - CVE-2026-42599
- TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759
- DbGate has cross site scripting via the SVG Icon String Handler component - CVE-2026-6216
- Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body - CVE-2026-115897
You might also like:
See something that needs correcting? Let us knowUpdated February 23, 2026