5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27125

CVE-2026-27125: Svelte SSR attribute spreading includes inherited properties from prototype chain

In server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27125

CVE-2026-27125:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
svelte	npm	<= 5.51.4	5.51.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of commit 73098bb26c6f06e7fd1b0746d817d2c5ee90755f reveals a security fix in Svelte's server-side rendering (SSR) functionality. The primary change is the introduction of a validation step within the element function in packages/svelte/src/internal/server/index.js. Before this patch, the function would accept a tag name and use it to build an HTML element without checking if the tag name was valid. The patch adds a regular expression check (REGEX_VALID_TAG_NAME.test(tag)) to ensure the tag name conforms to valid HTML/SVG/MathML or custom element naming conventions, preventing the injection of malicious code into the tag itself. The vulnerability description indicates that prototype pollution is a potential attack vector, which could allow an attacker to control the tag value passed to a <svelte:element>. The element function is the precise location where this malicious input was processed and rendered, making it the vulnerable function. The added test case, which attempts to render <svelte:element this={'svg onload=alert(1)'}>, confirms that this attack vector is now mitigated.

Vulnerable functions

element

packages/svelte/src/internal/server/index.js

The `element` function in Svelte's server-side rendering logic was vulnerable to cross-site scripting (XSS). It directly used the `tag` parameter to construct an HTML tag without prior validation. If an attacker could control the `tag` value, for example through prototype pollution on an object providing the tag name to a `<svelte:element>`, they could inject a malicious string (e.g., 'svg onload=alert(1)') as the tag name, leading to arbitrary code execution in the context of the rendered page.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.