GHSA-m56q-vw4c-c2cp

Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-27122

Packages

Ecosystem	Package	Affected	Fixed in
npm	svelte	< 5.51.5	5.51.5

Details

As written in the advisory (Markdown source, shown as plain text).

When using `<svelte:element this={tag}>` in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected.

References

External links from the advisory. They lead to third-party sites.

https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp web
https://nvd.nist.gov/vuln/detail/CVE-2026-27122 advisory
https://github.com/sveltejs/svelte package