Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

Description

Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.53.0, < 5.53.5
• Patched version(s): 5.53.5

References

• GHSA-qgvg-pr8v-6rr3
• CVE-2026-27902
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
• Svelte affected by cross-site scripting via spread attributes in Svelte SSR - CVE-2026-27121
• Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types - CVE-2026-31868
• Astro has Full-Read SSRF in error rendering via Host: header injection - CVE-2026-25545

Tags:

npm

svelte