GHSA-phwv-c562-gvmh

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-27901

Packages

Ecosystem	Package	Affected	Fixed in
npm	svelte	< 5.53.5	5.53.5

Details

As written in the advisory (Markdown source, shown as plain text).

The contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server.

References

External links from the advisory. They lead to third-party sites.

https://github.com/sveltejs/svelte/security/advisories/GHSA-phwv-c562-gvmh web
https://nvd.nist.gov/vuln/detail/CVE-2026-27901 advisory
https://github.com/sveltejs/svelte/commit/0df5abcae223058ceb95491470372065fb87951d web
https://github.com/sveltejs/svelte package
https://github.com/sveltejs/svelte/releases/tag/[email protected] web