Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
Date: 2026-02
Affected: npm/svelte
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-27901
CVE-2026-27902
CWE: CWE-79

Errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`.


Mitigations:

Architectural layers (MAESTRO):