CVE-2026-27122: Svelte SSR HTML Injection Vulnerability Due to Unvalidated Dynamic Element Tag Names
Summary
CVE-2026-27122: Svelte SSR does not validate dynamic element tag names in. Affects svelte versions < 5.51.5. Fixed in 5.51.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Svelte is a modern JavaScript framework for building user interfaces. It allows developers to create reactive components that compile into highly efficient JavaScript code. One of its features is server-side rendering (SSR), which enables rendering components on the server before sending them to the client. However, a vulnerability has been identified in the SSR process related to the use of dynamic element tags.
Vulnerability Detail
The vulnerability arises from the use of the <svelte:element this={tag}> syntax in server-side rendering. When a developer specifies a dynamic tag name, the framework does not validate or sanitize this input before it is included in the HTML output. If the provided tag name contains unexpected characters, it can lead to HTML injection, allowing an attacker to manipulate the rendered output. This could potentially compromise the integrity of the application and expose users to security risks. Client-side rendering is not affected by this issue.
How To Fix
Latest published version: 5.57.2 as of 23 Oct 2026
npm install svelte@5.57.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.51.5
This is the first release that contains the fix.
npm install svelte@5.51.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using dynamic tag names with <svelte:element> until you can update to the patched version. If dynamic behavior is necessary, ensure that the tag names are hardcoded or validated against a whitelist of safe tag names.
Conclusion
In summary, the vulnerability identified as CVE-2026-27122 in Svelte's server-side rendering can lead to HTML injection due to unvalidated dynamic element tag names. It is crucial to update to version 5.51.5 or later to mitigate this risk. For those unable to update immediately, implementing workarounds is recommended.
See every vulnerability recorded for svelte →
FAQ
The CVSS score for this vulnerability is 5.1, indicating a moderate severity level.
No, this vulnerability only affects server-side rendering in Svelte.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If you cannot update right away, avoid using dynamic tag names with <svelte:element> and consider hardcoding tag names or validating them against a whitelist.
More information can be found in the official advisory on GitHub or by reviewing the Svelte documentation regarding server-side rendering.
References
Related vulnerabilities
Recent vulnerabilities recorded for svelte.
