CVE-2026-27901: Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

February 26, 2026

The contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding’s initial value on the server.

References

github.com/advisories/GHSA-phwv-c562-gvmh
github.com/sveltejs/svelte
github.com/sveltejs/svelte/commit/0df5abcae223058ceb95491470372065fb87951d
github.com/sveltejs/svelte/releases/tag/svelte@5.53.5
github.com/sveltejs/svelte/security/advisories/GHSA-phwv-c562-gvmh
nvd.nist.gov/vuln/detail/CVE-2026-27901

Code Behaviors & Features

Detect and mitigate CVE-2026-27901 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →