5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27902

CVE-2026-27902: Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

Svelte performance oriented web framework. Prior to version 5.53.5, errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError. Version 5.53.5 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27902

CVE-2026-27902:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
svelte	npm	>= 5.53.0, < 5.53.5	5.53.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2026-27902, is a cross-site scripting (XSS) issue in Svelte's server-side rendering (SSR) mechanism. The root cause is the improper handling of errors within a <svelte:boundary>. When an error is thrown inside a boundary during SSR, Svelte is designed to catch the error and embed information about it within an HTML comment in the rendered output. This allows the client-side code to correctly hydrate the component.

The vulnerability lies in the fact that the error object, which can be modified by the developer using the transformError function, was not sanitized before being included in the comment. The error was simply converted to a JSON string. An attacker able to control the content of the error could inject a string like --> <script>alert('XSS')</script> which would close the HTML comment prematurely and allow the execution of arbitrary JavaScript in the user's browser.

The analysis of the patch commit 0298e979371bb583855c9810db79a70a551d22b9 pinpoints the vulnerable code within the Renderer class located at packages/svelte/src/internal/server/renderer.js. The patch replaces direct and unsafe JSON.stringify() calls with a new, safe method Renderer.#serialize_failed_boundary. This new method escapes HTML-sensitive characters (< and >) within the JSON string, thus preventing the injection of malicious HTML. The vulnerable code was identified in the Renderer.boundary method and the private Renderer.#collect_content_async method, which are directly involved in rendering error states for boundaries.

Vulnerable functions

Renderer.boundary

packages/svelte/src/internal/server/renderer.js

The `boundary` method in the `Renderer` class was vulnerable to XSS. When an error occurred within a `svelte:boundary` during server-side rendering, this method would serialize the error object to JSON and embed it in an HTML comment without proper escaping. If an attacker could control the content of the error (via the `transformError` option), they could inject malicious HTML, such as a closing comment tag (`-->`) followed by a script tag, to execute arbitrary code.

Renderer.#collect_content_async

packages/svelte/src/internal/server/renderer.js

The private method `#collect_content_async` in the `Renderer` class also contained the XSS vulnerability. During the asynchronous rendering process, if a boundary failed, this method would also embed the unescaped, JSON-serialized error into an HTML comment. This provided another vector for the same XSS attack if the rendering was asynchronous.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.