Is svelte 5.35 vulnerable?
npm · 8 releases from 5.35.0 to 5.35.7 · latest svelte is 5.57.3 · checked 2 Nov 2026
Yes: 6 known advisories
Yes. svelte 5.35.7, the last 5.35 release, is affected by 6 known security advisories (6 medium), including CVE-2026-42573, CVE-2026-42599, CVE-2026-27901. Upgrade to 5.55.7 or later to fix all of them.
npm install svelte@5.55.7Advisories affecting svelte 5.35.7
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
- Affected
- <5.55.7
- Fixed in
- 5.55.7
Svelte SSR vulnerable to cross-site scripting via spread attributes
- Affected
- <5.55.7
- Fixed in
- 5.55.7
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
- Affected
- <5.53.5
- Fixed in
- 5.53.5
Svelte SSR attribute spreading includes inherited properties from prototype chain
- Affected
- <5.51.5
- Fixed in
- 5.51.5
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
- Affected
- <5.51.5
- Fixed in
- 5.51.5
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
- Affected
- <5.51.5
- Fixed in
- 5.51.5
Which of your client projects are still on svelte 5.35?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact svelte version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other svelte versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.