CVE-2026-27901: Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

February 26, 2026

The contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding’s initial value on the server.

References

github.com/advisories/GHSA-phwv-c562-gvmh
github.com/sveltejs/svelte
github.com/sveltejs/svelte/commit/0df5abcae223058ceb95491470372065fb87951d
github.com/sveltejs/svelte/releases/tag/svelte@5.53.5
github.com/sveltejs/svelte/security/advisories/GHSA-phwv-c562-gvmh
nvd.nist.gov/vuln/detail/CVE-2026-27901

Code Behaviors & Features

Detect and mitigate CVE-2026-27901 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →