5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27121

CVE-2026-27121: Svelte affected by cross-site scripting via spread attributes in Svelte SSR

Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27121

CVE-2026-27121:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
svelte	npm	<= 5.51.4	5.51.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a cross-site scripting (XSS) issue in Svelte's server-side rendering (SSR) caused by the improper handling of spread attributes. Malicious event handlers could be injected if an application uses spread syntax with untrusted data. The analysis of the patch between the vulnerable version 5.51.4 and the patched version 5.51.5 revealed a key change in the packages/svelte/src/internal/server/index.js file. Specifically, commit a0c7f289156e9fafaeaf5ca14af6c06fe9b9eae5 introduces a fix to strip event handlers during SSR. The change is located within the attributes function, which now includes logic to explicitly ignore any attribute starting with on. This directly addresses the vulnerability by preventing event handlers from being rendered into the HTML output. Therefore, the attributes function is identified as the vulnerable function, as it was the component responsible for processing and rendering the malicious attributes before the fix was applied.

Vulnerable functions

attributes

packages/svelte/src/internal/server/index.js

The `attributes` function is responsible for rendering HTML attributes during server-side rendering. Prior to the patch, this function did not filter out event handler attributes (e.g., `onclick`, `onerror`) when processing spread attributes. This allowed user-provided data containing malicious event handlers to be rendered directly into the HTML, leading to a cross-site scripting (XSS) vulnerability. The patch introduces a check to specifically omit any attribute starting with 'on', thus preventing the injection of event handlers.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.