Svelte Support & Health

GHSA-6738-r8g5-qwp3 CVSS_V4

svelte vulnerable to Cross-site Scripting

Published: 2026-01-15 Fixed in: 5.46.4

GHSA-8266-84wp-wv5c CVSS_V3

Svelte has a potential mXSS vulnerability due to improper HTML escaping

Published: 2024-08-30 Fixed in: 4.2.19

GHSA-9rmh-mm8f-r9h6 CVSS_V4

Svelte: ReDoS in `<svelte:element>` Tag Validation

Published: 2026-05-14 Fixed in: 5.55.7

GHSA-crpf-4hrx-3jrp CVSS_V4

Svelte SSR attribute spreading includes inherited properties from prototype chain

Published: 2026-02-19 Fixed in: 5.51.5

GHSA-f3cj-j4f6-wq85 CVSS_V4

Svelte: SSR XSS via Insecure Promise Serialization in hydratable

Published: 2026-05-14 Fixed in: 5.55.7

GHSA-f7gr-6p89-r883 CVSS_V4

Svelte affected by cross-site scripting via spread attributes in Svelte SSR

Published: 2026-02-19 Fixed in: 5.51.5

GHSA-gw32-9rmw-qwww CVSS_V4

svelte is vulnerable to XSS with textarea bind:value

Published: 2026-01-16 Fixed in: 3.59.2

GHSA-h7h7-mm68-gmrc CVSS_V4

Svelte affected by XSS in SSR `<option>` element

Published: 2026-02-19 Fixed in: 5.51.5

GHSA-m56q-vw4c-c2cp CVSS_V4

Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

Published: 2026-02-19 Fixed in: 5.51.5

GHSA-phwv-c562-gvmh CVSS_V4

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

Published: 2026-02-26 Fixed in: 5.53.5

Svelte