VulnSocial

CVE-2026-27125Disclosure(svelte / svelte)

LOWCVSS 6.8 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch svelte svelte systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.

svelte CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-915

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • svelte

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
svelte
Products
svelte

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-02-20: 2Patch / Workaround · 2026-02-20: 1Technical Details · 2026-02-20: 202-20
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets3 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-27125 Prototype Pollution in Svelte SSR Attribute Spreading Prior to 5.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27125 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The tweet announces the CVE-2026-27125 vulnerability, describing it as prototype pollution in Svelte SSR attribute spreading before version 5, and provides a link to a vulnerability details page.

    0000031
    4.0K followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-27125 svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. &lt;div {...attrs}&gt;) enumerates inherited pro… https://www.cve.org/CVERecord?id=CVE-2026-27125

    Post summary

    The CVE targets Svelte’s server‑side rendering via attribute spreading and is resolved by upgrading to version 5.51.5.

    0000072
    56.4K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsveltesvelte-node.js-

Explore more

Back to dashboardsvelte CVEssvelte vulnerabilities