Svelte affected by XSS in SSR `<option>` element
Date: 2026-02
Affected: npm/svelte
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-27119
CWE: CWE-79

In certain circumstances, the server-side rendering output of an `<option>` element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.


Mitigations:

Architectural layers (MAESTRO):