5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27119

CVE-2026-27119: Svelte affected by XSS in SSR `<option>` element

In certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27119

CVE-2026-27119:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
svelte	npm	>= 5.39.3, < 5.51.5	5.51.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is an XSS in the SSR of <option> elements in Svelte. By analyzing the commits between the last vulnerable version (5.51.4) and the first patched version (5.51.5), I identified the exact code changes that addressed the vulnerability. The key change is in the packages/svelte/src/internal/server/renderer.js file, within the Renderer class. Specifically, the option method and its helper function close were modified to ensure that the content of the <option> tag is properly escaped using escape_html. The vulnerable code was directly pushing the unescaped content to the output buffer. Therefore, the Renderer.option function is the vulnerable function, as it is the entry point for rendering the <option> element and contained the flawed logic.

Vulnerable functions

Renderer.option

packages/svelte/src/internal/server/renderer.js

The `option` method in the `Renderer` class was vulnerable to XSS. It rendered the content of an `<option>` tag without proper HTML escaping. An attacker could provide a malicious string to be used as the option's content, which would then be rendered as raw HTML in the server-side rendered output, leading to a cross-site scripting vulnerability. The patch fixes this by using the `escape_html` function on the content before rendering.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.