CVE-2026-27121: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27121 is a cross-site scripting (XSS) vulnerability in the Svelte JavaScript framework affecting server-side rendering (SSR). When spread syntax is used to render attributes from untrusted data, event handler properties are incorrectly included in the rendered HTML output, allowing attackers to inject malicious event handlers that execute in victims' browsers. All versions of the svelte npm package up to and including 5.51.4 are affected; the issue is fixed in version 5.51.5. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Svelte Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). During SSR, Svelte's spread attribute rendering does not filter out event handler properties (e.g., onclick, onmouseover) from untrusted input objects before including them in the server-rendered HTML. If an application passes user-controlled or externally sourced data directly to a component using spread syntax (e.g., <div {...userControlledData}>), any event handler keys in that object are rendered verbatim into the HTML, bypassing Svelte's normal client-side sanitization. Exploitation requires that the application spreads untrusted data as element attributes and that a victim user loads or interacts with the affected page (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to inject arbitrary JavaScript event handlers into server-rendered HTML pages, which execute in the context of victims' browsers when they visit or interact with the affected page. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and potential for further attacks such as phishing or malware delivery. The subsequent system impact (e.g., downstream users' browsers) is rated high for both confidentiality and integrity, while the directly vulnerable server system has limited confidentiality impact and no integrity or availability impact (GitHub Advisory, Svelte Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.043% (1st percentile), indicating a low near-term probability of exploitation. Exploitation requires specific application-level conditions — namely, that the target application spreads untrusted data as element attributes in SSR — which limits the attack surface (GitHub Advisory).

1. Identify a vulnerable target: Find a web application built with Svelte (npm package svelte ≤ 5.51.4) that uses SSR and spreads user-controlled or externally sourced data as element attributes (e.g., <div {...userData}>).
2. Craft a malicious payload: Prepare an input object containing an event handler property with a malicious JavaScript payload, such as { onclick: "alert(document.cookie)" } or a more sophisticated payload for session hijacking.
3. Inject the payload: Submit the crafted data through any application input that is subsequently spread as element attributes during SSR — this could be a form field, URL parameter, API response, or database-stored value, depending on the application's data flow.
4. Deliver the page to a victim: The server renders the HTML with the injected event handler attribute (e.g., <div onclick="alert(document.cookie)">) and serves it to a victim user.
5. Trigger execution: When the victim loads the page and interacts with the affected element (or if the event fires automatically, e.g., onload), the injected JavaScript executes in their browser, enabling cookie theft, credential harvesting, or further exploitation (GitHub Advisory, Svelte Advisory).

• Network: Unusual outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages served by the Svelte SSR application.
• Logs: Server-side access logs showing requests containing event handler property names (e.g., onclick, onmouseover, onerror) in user-supplied input fields or parameters that are spread as element attributes.
• HTML Output: Server-rendered HTML responses containing inline event handler attributes (e.g., onclick=, onload=) on elements that should not normally have them, especially with encoded or obfuscated JavaScript payloads.
• Application Behavior: Unexpected JavaScript execution reported by users, such as alert dialogs, redirects, or unauthorized actions occurring upon page load or element interaction.

The primary remediation is to upgrade the svelte npm package to version 5.51.5 or later, which filters event handler properties from spread attributes during SSR (GitHub Advisory, Svelte Advisory). As a workaround prior to patching, developers should sanitize or allowlist all data before spreading it as element attributes in SSR components, explicitly removing any keys that begin with on (event handler prefixes). Implementing a strict Content Security Policy (CSP) that disallows inline event handlers can also reduce the risk of exploitation.

The vulnerability was discovered and reported by a GitHub user identified as elliott-with-the-longest-name-on-github and published to the GitHub Advisory Database on February 18–19, 2026. Red Hat tracked the issue via their Bugzilla system (Bug 2441532) and classified it as medium severity. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory, Red Hat Bugzilla).