Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-20 | 1 | Disclosure1 |
| 2026-02-21 | 1 | General1 |
CVE-2026-27122 HTML Injection Vulnerability in Svelte Server-Side Rendering Before 5.51.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27122
Post summary
The text announces the existence of CVE-2026-27122, describing it as an HTML injection issue in Svelte Server-Side Rendering for versions prior to 5.51.5, but provides no further actionable details.
CVE-2026-27122 svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or… https://www.cve.org/CVERecord?id=CVE-2026-27122
Post summary
The text announces a CVE‑2026‑27122 affecting Svelte, describing an unvalidated tag name issue in server‑side rendering before version 5.51.5, with a link to the CVE record.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | svelte | svelte | - | node.js | - |