CVE-2026-27119: Svelte affected by XSS in SSR `<option>` element
In certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.
Other sources
svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27119?
CVE-2026-27119 is categorized as a medium severity vulnerability due to the potential for HTML injection.
How do I fix CVE-2026-27119?
To fix CVE-2026-27119, update the Svelte package to version 5.51.5 or later.
What types of applications are affected by CVE-2026-27119?
CVE-2026-27119 affects server-side rendering of applications using the Svelte framework in specific versions.
Does CVE-2026-27119 affect client-side rendering?
No, CVE-2026-27119 only affects the server-side rendering output and does not impact client-side rendering.
What can happen if CVE-2026-27119 is exploited?
Exploitation of CVE-2026-27119 could lead to unauthorized HTML content being injected into the server-side rendered output.