CVE-2026-27125: Svelte SSR Attribute Spreading Vulnerability
Summary
CVE-2026-27125: Svelte SSR attribute spreading includes inherited properties from prototype chain. Affects svelte versions < 5.51.5. Fixed in 5.51.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Svelte is a modern JavaScript framework that enables developers to build user interfaces with a focus on performance and simplicity. It compiles components into highly efficient JavaScript at build time, allowing for faster client-side rendering. However, in server-side rendering (SSR), Svelte has a vulnerability related to attribute spreading that can lead to unintended consequences when inherited properties from the prototype chain are included.
Vulnerability Detail
The vulnerability arises during server-side rendering when attribute spreading is performed on elements, such as <div {...attrs}>. This process enumerates inherited properties from the object's prototype chain instead of only considering the object's own properties. In scenarios where Object.prototype has been polluted, this can lead to unexpected attributes appearing in the SSR output or even cause errors during rendering. The issue does not affect client-side rendering, but it poses a risk in server-side environments, particularly when dealing with untrusted input.
How To Fix
Latest published version: 5.57.2 as of 23 Oct 2026
npm install svelte@5.57.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.51.5
This is the first release that contains the fix.
npm install svelte@5.51.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually filter the attributes before spreading them to ensure that only the object's own properties are included. For example:
const filteredAttrs = Object.keys(attrs).reduce((acc, key) => { if (attrs.hasOwnProperty(key)) { acc[key] = attrs[key];
} return acc; }, {}); <div {...filteredAttrs}>.
Conclusion
The CVE-2026-27125 vulnerability in Svelte poses a risk during server-side rendering due to improper attribute spreading. It is crucial to update to version 5.51.5 or later to mitigate this issue. Implementing the suggested workaround can also help in the interim. Utilizing tools like Vulert can further enhance your application's security posture.
See every vulnerability recorded for svelte →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
No, this vulnerability only affects server-side rendering in Svelte applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update to the patched version, consider implementing the provided workaround to filter attributes before spreading them.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just package-lock.json, helping you maintain the security of your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for svelte.
