Browse CVEs

HIGH 7.5 CVE-2026-42570 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to be… Devalue 5.8.1+ Fix from $1,9502026-06-09 HIGH 7.5 CVE-2026-42567 Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take expone… Svelte 5.55.7+ Fix from $1,9502026-06-09 MEDIUM 6.1 CVE-2026-42573 Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on e… Svelte 5.55.7+ Fix from $1,6002026-06-09 MEDIUM 6.1 CVE-2026-42599 Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event han… Svelte 5.55.7+ Fix from $1,6002026-06-09 HIGH 7.5 CVE-2026-40073 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, reque… Kit 2.57.1+ Fix from $1,9502026-04-10 HIGH 7.5 CVE-2026-40074 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside … Kit 2.57.1+ Fix from $1,9502026-04-10 HIGH 7.5 CVE-2026-30226 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and ea… Devalue 5.6.4+ Fix from $1,9502026-03-11 MEDIUM 5.4 CVE-2026-27902 Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded i… Svelte 5.53.5+ Fix from $1,6002026-02-26 MEDIUM 6.1 CVE-2026-27901 Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elem… Svelte 5.53.5+ Fix from $1,6002026-02-26 MEDIUM 6.8 CVE-2026-27125 svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumera… Svelte 5.51.5+ Fix from $1,6002026-02-20 MEDIUM 5.4 CVE-2026-27119 svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element d… Svelte 5.51.5+ Fix from $1,6002026-02-20 MEDIUM 5.4 CVE-2026-27121 svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side renderi… Svelte 5.51.5+ Fix from $1,6002026-02-20 MEDIUM 5.4 CVE-2026-27122 svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is… Svelte 5.51.5+ Fix from $1,6002026-02-20 MEDIUM 6.1 CVE-2025-15265 An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a <script> block without HTML… Svelte 5.46.3+ Fix from $1,6002026-01-15 HIGH 7.5 CVE-2026-22803 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote… Kit 2.49.5+ Fix from $1,9502026-01-15 HIGH 7.5 CVE-2026-22774 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, cer… Devalue 5.6.2+ Fix from $1,9502026-01-15 HIGH 7.5 CVE-2026-22775 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, cer… Devalue 5.6.2+ Fix from $1,9502026-01-15 CRITICAL 9.1 CVE-2025-67647 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a serve… Adapter Node 2.49.5 / 5.5.1+ Fix from $2,3002026-01-15 MEDIUM 5.4 CVE-2024-53261 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows int… Sveltekit 2.8.3+ Fix from $1,6002024-11-25 MEDIUM 5.4 CVE-2024-53262 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains … Sveltekit 2.8.3+ Fix from $1,6002024-11-25 MEDIUM 6.1 CVE-2024-45047 svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improp… Svelte 4.2.19+ Fix from $1,6002024-08-30 HIGH 7.5 CVE-2024-23641 SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `R… Adapter Node 2.1.2 / 2.4.3+ Fix from $1,9502024-01-24 HIGH 8.8 CVE-2023-29008 The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint han… Sveltekit 1.15.2+ Fix from $1,9502023-04-06 HIGH 8.8 CVE-2023-29003 SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a … Sveltekit 1.15.1+ Fix from $1,9502023-04-04 MEDIUM 6.1 CVE-2022-25875 The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes… Svelte 3.49.0+ Fix from $1,6002022-07-12 HIGH 7.8 CVE-2021-29261 The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuratio… Svelte 104.8.0+ Fix from $1,9502021-04-05