CVE-2026-27902: Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
Published Feb 26, 2026
·Updated
Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError.
Affected Software
3 affected componentsFixes available
npm/svelte<5.53.5
npm/svelte>=5.53.0<5.53.5
5.53.5
svelte Svelte Node.js>=5.53.0<5.53.5
Remediation
Event History
Feb 26, 2026
CVE Published
via MITRE·12:58 AM
Data Sourced
via MITRE·12:58 AM
DescriptionWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 AM
RemedyAffected Software
Advisory Published
via GitHub·10:25 PM
Data Sourced
via GitHub·10:25 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-27902?
CVE-2026-27902 is considered to have a medium severity rating due to the potential for XSS attacks.
2
How do I fix CVE-2026-27902?
To fix CVE-2026-27902, users should upgrade to Svelte version 5.53.5 or later.
3
What types of vulnerabilities does CVE-2026-27902 expose?
CVE-2026-27902 exposes the application to cross-site scripting (XSS) vulnerabilities through HTML comment injection.
4
Which versions of Svelte are affected by CVE-2026-27902?
CVE-2026-27902 affects Svelte versions from 5.53.0 up to but not including 5.53.5.
5
Are all Svelte applications vulnerable to CVE-2026-27902?
Not all Svelte applications are vulnerable, but those using affected versions without mitigation may be at risk.