Description
Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:
- you are using
hydratable(an experimental feature at the time of this report) - you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g.
Recommendation
Update the svelte package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.46.0, <= 5.55.6
- Patched version(s): 5.55.7
References
Related Issues
- Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers - CVE-2026-27902
- Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas - Vulnerability
- Svelte affected by cross-site scripting via spread attributes in Svelte SSR - CVE-2026-27121
- Svelte affected by XSS in SSR `<option>` element - CVE-2026-27119
You might also like:
- Tags:
- npm
- svelte
Anything's wrong? Let us know Last updated on May 14, 2026