CVE Tools
Track your stack

Svelte

15 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Svelte, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Svelte CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Svelte CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-012
2026-026
2026-030
2026-040
2026-051
2026-063
2026-070
2026-080
2026-090
2026-100

Severity

How the 15 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • High215%
  • Medium1185%

Latest CVEs

The 15 most recently published vulnerabilities affecting Svelte.

  1. CVE-2026-42599Cross-site scripting via spread attributes in Svelte SSR6.1
  2. CVE-2026-42567Svelte: ReDoS in `<svelte:element>` Tag Validation7.5
  3. CVE-2026-42573Svelte: XSS via DOM Clobbering of Internal Framework State6.1
  4. GHSA-f3cj-j4f6-wq85Svelte: SSR XSS via Insecure Promise Serialization in hydratable—
  5. CVE-2026-27902Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers5.4
  6. CVE-2026-27901Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`6.1
  7. CVE-2026-27125Svelte SSR attribute spreading includes inherited properties from prototype chain6.8
  8. CVE-2026-27122Svelte SSR does not validate dynamic element tag names in `<svelte:element>`5.4
  9. CVE-2026-27121Svelte affected by cross-site scripting via spread attributes in Svelte SSR5.4
  10. CVE-2026-27119Svelte affected by XSS in SSR `<option>` element5.4
  11. GHSA-gw32-9rmw-qwwwsvelte is vulnerable to XSS with textarea bind:value—
  12. CVE-2025-15265Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)6.1
  13. CVE-2024-45047Potential mXSS vulnerability due to improper HTML escaping in svelte5.4
  14. CVE-2022-25875Cross-site Scripting (XSS)5.4
  15. CVE-2021-29261The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration.7.8

Product grouping is registry-driven, with AI assist and human review. How it works