MediumGHSA-qgvg-pr8v-6rr3CVE-2026-27902

Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

Published 26 Feb 2026 · Updated 26 Feb 2026

Affected package

Affected: >=5.53.0 <5.53.5
Fixed in: 5.53.5

Update to the fixed version for your release line, for example:npm install svelte@5.53.5

Details

Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError.

Is GHSA-qgvg-pr8v-6rr3 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected svelte, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Linkgithub.com/sveltejs/svelte/security/advisories/GHSA-qgvg-pr8v-6rr3
Advisorynvd.nist.gov/vuln/detail/CVE-2026-27902
Linkgithub.com/sveltejs/svelte/commit/0298e979371bb583855c9810db79a70a551d22b9
Packagegithub.com/sveltejs/svelte
Linkgithub.com/sveltejs/svelte/releases/tag/svelte@5.53.5

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.