CVE-2026-27901: Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Svelte performance oriented web framework. Prior to version 5.53.5, the contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27901?
CVE-2026-27901 is classified as a medium severity vulnerability due to its potential for allowing cross-site scripting (XSS) attacks.
How do I fix CVE-2026-27901?
To fix CVE-2026-27901, upgrade Svelte to version 5.53.5 or later.
What areas of Svelte are affected by CVE-2026-27901?
CVE-2026-27901 affects the `bind:innerText` and `bind:textContent` attributes on `contenteditable` elements.
When was CVE-2026-27901 discovered?
CVE-2026-27901 was discovered prior to the release of Svelte version 5.53.5.
What issues can arise from CVE-2026-27901 if not addressed?
If not addressed, CVE-2026-27901 could enable an attacker to inject malicious HTML via XSS in applications using the affected Svelte versions.