Bug 2442917 (CVE-2026-27902) - CVE-2026-27902 svelte: Svelte: Cross-Site Scripting via unsanitized error output
Summary: CVE-2026-27902 svelte: Svelte: Cross-Site Scripting via unsanitized error output
Keywords:
Status: NEW
Alias: CVE-2026-27902
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2443051
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-02-26 02:01 UTC by OSIDB Bzimport
Modified: 2026-02-26 18:08 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-02-26 02:01:29 UTC 
Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.
Note You need to log in before you can comment on or make changes to this bug.