CVE-2026-27122

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27122", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T18:42:27.043Z", "datePublished": "2026-02-20T22:28:37.824Z", "dateUpdated": "2026-02-23T19:23:03.403Z"}, "containers": {"cna": {"title": "Svelte SSR does not validate dynamic element tag names in `<svelte:element>`", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp"}], "affected": [{"vendor": "sveltejs", "product": "svelte", "versions": [{"version": "< 5.51.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T22:28:37.824Z"}, "descriptions": [{"lang": "en", "value": "svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5."}], "source": {"advisory": "GHSA-m56q-vw4c-c2cp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T19:22:44.293082Z", "id": "CVE-2026-27122", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:23:03.403Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27122", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T19:22:44.293082Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:22:53.632Z"}}], "cna": {"title": "Svelte SSR does not validate dynamic element tag names in `<svelte:element>`", "source": {"advisory": "GHSA-m56q-vw4c-c2cp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "sveltejs", "product": "svelte", "versions": [{"status": "affected", "version": "< 5.51.5"}]}], "references": [{"url": "https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp", "name": "https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T22:28:37.824Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27122", "state": "PUBLISHED", "dateUpdated": "2026-02-23T19:23:03.403Z", "dateReserved": "2026-02-17T18:42:27.043Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-20T22:28:37.824Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "svelte", "vendor": "sveltejs", "versions": [{"status": "affected", "version": "< 5.51.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "95D3F8E1-FD81-4A9E-900E-5C66951A10BB", "versionEndExcluding": "5.51.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5."}, {"lang": "es", "value": "framework web svelte orientado al rendimiento. Antes de 5.51.5, al usar en la renderizaci\u00f3n del lado del servidor, el nombre de etiqueta proporcionado no se valida ni se sanea antes de ser emitido en la salida HTML. Si la cadena de etiqueta contiene caracteres inesperados, puede resultar en inyecci\u00f3n HTML en la salida SSR. La renderizaci\u00f3n del lado del cliente no se ve afectada. Esta vulnerabilidad se ha corregido en 5.51.5."}], "id": "CVE-2026-27122", "lastModified": "2026-06-17T10:26:42.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27122", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T19:22:44.293082Z", "version": "2.0.3"}}]}, "published": "2026-02-20T23:16:02.640", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "svelte: Svelte SSR does not validate dynamic element tag names in `<svelte:element>`", "id": "2441520", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441520"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-1286", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-27122", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:0", "fix_state": "Fix deferred", "package_name": "rhdesktop/rh-podman-desktop-ext-bootc-rhel10", "product_name": "Red Hat Build of Podman Desktop - Tech Preview"}], "public_date": "2026-02-20T22:28:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-27122\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27122\nhttps://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.51.5)"}}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "svelte", "source": "cna", "vendor": "sveltejs"}, "product": "svelte", "vendor": "svelte"}], "analysis": {"en": {"generated_at": "2026-04-18T11:22:55.201681+00:00", "value": {"mitigation_remediation": ["Update the Svelte framework to version 5.51.5 or later to receive the vendor\u2019s fix.", "If an upgrade is not feasible, validate and sanitize the tag name on the server side (CWE\u20111286) before passing it to `<svelte:element>`, restricting to a whitelist of safe tags, and ensure any embedded content is properly escaped (CWE\u201179).", "Avoid using `<svelte:element this={tag}>` with user\u2011controlled input in SSR contexts until a patch is applied."], "summary": {"action": "Patch Now", "impact": "HTML Injection via server\u2011side rendering"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Svelte framework released by sveltejs:svelte and applies to all versions prior to 5.51.5 when the SSR mode is used. Client\u2011side rendering is not impacted and the issue does not affect earlier releases of Node.js or other dependencies that rely on Svelte.", "description_and_impact": "A server\u2011side rendering feature in Svelte allows dynamic element tags via `<svelte:element this={tag}>`. Before version 5.51.5 the framework does not validate or sanitize the tag string, so an attacker can craft a tag value containing malicious characters that end up in the generated HTML, enabling HTML injection or cross\u2011site scripting in the rendered page. The weakness aligns with CWE\u20111286 (Improper Validation of Input or Parameters) and CWE\u201179 (Cross\u2011Site Scripting), illustrating that the lack of input validation leads to an XSS vulnerability.", "risk_and_exploitability": "The assessment assigns a CVSS score of 5.1, indicating moderate severity, and an EPSS of less than 1%, suggesting a low probability of exploitation in the wild. Because the vulnerability is not listed in the CISA KEV catalog, no widespread exploitation campaigns are currently documented. The likely attack vector is server\u2011side rendering of untrusted content; an attacker would need to supply a malicious tag string that the application uses with `<svelte:element>`, which then appears in the HTML response delivered to users, potentially leading to XSS. No prerequisites beyond supplying input to the SSR endpoint are indicated by the description."}}}}, "created": "2026-02-23T14:33:33.598027+00:00", "updated": "2026-04-18T11:30:44.316042+00:00", "vendors": ["svelte", "svelte$PRODUCT$svelte"]}