CVE-2026-27122: Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
Other sources
When using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27122?
CVE-2026-27122 is considered a critical security vulnerability due to its potential impact on server-side rendering in Svelte applications.
How do I fix CVE-2026-27122?
To fix CVE-2026-27122, update your Svelte package to version 5.51.5 or higher.
What does CVE-2026-27122 affect?
CVE-2026-27122 affects Svelte applications that utilize server-side rendering with dynamic elements specified by user input.
How can CVE-2026-27122 be exploited?
CVE-2026-27122 can be exploited if unvalidated tag names are rendered, allowing attackers to inject arbitrary HTML into the server output.
Which versions of Svelte are vulnerable to CVE-2026-27122?
Versions of Svelte prior to 5.51.5 are vulnerable to CVE-2026-27122.