svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-m56q-vw4c-c2cp | Svelte SSR does not validate dynamic element tag names in `<svelte:element>` |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 20 Feb 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5. | |
| Title | Svelte SSR does not validate dynamic element tag names in `<svelte:element>` | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-02-20T22:28:37.824Z
Reserved: 2026-02-17T18:42:27.043Z
Link: CVE-2026-27122
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-02-20T23:16:02.640
Modified: 2026-02-20T23:16:02.640
Link: CVE-2026-27122
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses