svelte
5.57.3web development for the rest of us
- Maintenance
- Active164 commits in 3 months · bus factor 1
- License
- MITPermissive · OSI-approved
- Security
- 13 advisories1 high, 12 medium · Scorecard 7.6/10
- Supported versions
- 1 line supportednewest 5 · 4 ended
88.8k stars · 6.1k forks · 1.3k open issues · last release 19 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 13 most recent advisories published by the maintainers: 1 high, 12 medium. Check the patched version against the one you run.
- mediumGHSA-f3cj-j4f6-wq85May 14, 2026SSR XSS via Insecure Promise Serialization in hydratable
- Affected
- >=5.46.0 <=5.55.6
- Patched in
- 5.55.7
- mediumCVE-2026-42567May 14, 2026ReDoS in `<svelte:element>` Tag Validation
- Affected
- >=5.51.5 <=5.55.6
- Patched in
- 5.55.7
- mediumCVE-2026-42573May 14, 2026XSS via DOM Clobbering of Internal Framework State
- Affected
- <=5.55.6
- Patched in
- 5.55.7
- mediumCVE-2026-42599May 14, 2026Cross-site scripting via spread attributes in Svelte SSR
- Affected
- <=5.55.6
- Patched in
- 5.55.7
- mediumCVE-2026-27901Feb 25, 2026XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
- Affected
- <=5.53.4
- Patched in
- 5.53.5
- mediumCVE-2026-27902Feb 25, 2026XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
- Affected
- >=5.53.0 <=5.53.4
- Patched in
- 5.53.5
- mediumCVE-2026-27119Feb 18, 2026XSS in SSR `<option>` element
- Affected
- >=5.39.3, <=5.51.4
- Patched in
- 5.51.5
- mediumCVE-2026-27121Feb 18, 2026Cross-site scripting via spread attributes in Svelte SSR
- Affected
- <=5.51.4
- Patched in
- 5.51.5
- mediumCVE-2026-27122Feb 18, 2026Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
- Affected
- <=5.51.4
- Patched in
- 5.51.5
- mediumCVE-2026-27125Feb 18, 2026Svelte SSR attribute spreading includes inherited properties from prototype chain
- Affected
- <=5.51.4
- Patched in
- 5.51.5
- highGHSA-gw32-9rmw-qwwwJan 16, 2026XSS with textarea bind:value
- Affected
- >=3.0.0
- Patched in
- 3.59.2
- mediumCVE-2025-15265Jan 15, 2026Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in svelte
- Affected
- >=5.46.0, <=5.46.3
- Patched in
- 5.46.4
- mediumCVE-2024-45047Aug 30, 2024Potential XSS vulnerability due to improper HTML attribute escaping
- Affected
- < 4.2.19
- Patched in
- 4.2.19, 5