CVE-2026-27121

svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. This vulnerability is fixed in 5.51.5.

• CWE-79

• https://github.com/sveltejs/svelte/security/advisories/GHSA-f7gr-6p89-r883Vendor Advisory

Published

Feb 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27116Vikunja is an open-source self-hosted task management platfo…6.1
• CVE-2026-27117bit7z is a cross-platform C++ static library that allows the…7.5
• CVE-2026-27118SvelteKit is a framework for rapidly developing robust, perf…5.3
• CVE-2026-27119svelte performance oriented web framework. From 5.39.3, <=5.…5.4
• CVE-2026-2712The WP-Optimize plugin for WordPress is vulnerable to unauth…5.4
• CVE-2026-27120Leafkit is a templating language with Swift-inspired syntax.…6.1
• CVE-2026-27122svelte performance oriented web framework. Prior to 5.51.5, …5.4
• CVE-2026-27123Rejected reason: Reason: This candidate was issued in error.
• CVE-2026-27124FastMCP is the standard framework for building MCP applicati…6.1
• CVE-2026-27125svelte performance oriented web framework. Prior to 5.51.5, …6.8
• CVE-2026-27126Craft is a content management system (CMS). In versions 4.5.…4.8
• CVE-2026-27127Craft is a content management system (CMS). In versions 4.5.…6.3