Svelte SSR vulnerable to cross-site scripting via spread attributes
Date: 2026-05
Affected: npm/svelte
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-27121
CVE-2026-42599
CWE: CWE-79

When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability _only_ triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires. This is similar to but different from [CVE-2026-27121](https://nvd.nist.gov/vuln/detail/CVE-2026-27121).


Mitigations:

Architectural layers (MAESTRO):