CVE-2026-27122: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27122 is an HTML injection vulnerability in the Svelte JavaScript framework affecting its server-side rendering (SSR) engine. When using <svelte:element this={tag}>, the provided tag name is not validated or sanitized before being emitted into the HTML output, allowing injection of arbitrary HTML if the tag string contains unexpected characters. All versions of the svelte npm package up to and including 5.51.4 are affected; client-side rendering is not impacted. The vulnerability was published on February 18, 2026, and carries a CVSS v3.1 score of 5.4 (Medium) and a CVSS v4.0 score of 5.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper validation of syntactic correctness of input (CWE-1286) combined with improper neutralization of input during web page generation (CWE-79). During SSR, Svelte's <svelte:element this={tag}> construct directly interpolates the tag value into the rendered HTML string without sanitizing or validating it against an allowlist of valid HTML tag names. An attacker who can control the value passed to the this attribute — for example, through user-supplied data flowing into a Svelte component — can inject arbitrary HTML markup into the server-rendered page. Client-side rendering is unaffected because the DOM's own element creation APIs enforce tag name validity (GitHub Advisory, Svelte Security Advisory).

Successful exploitation allows an attacker to inject arbitrary HTML into SSR-generated pages, which can be leveraged for cross-site scripting (XSS) attacks against users who receive the affected server-rendered output. This can result in session hijacking, credential theft, defacement, or delivery of malicious scripts to end users. The CVSS v4.0 scoring reflects a high subsequent-system confidentiality and integrity impact, indicating that downstream user sessions and data can be significantly compromised even though the vulnerable system itself has limited direct exposure (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.043% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control user-supplied input that flows into the this attribute of a <svelte:element> component in an SSR context, which limits the attack surface to applications that pass unsanitized external data to this construct (GitHub Advisory, Feedly).

1. Identify target: Find a web application using Svelte for server-side rendering (SvelteKit or similar) with version ≤ 5.51.4 that passes user-controlled input to a <svelte:element this={tag}> component.
2. Locate injection point: Identify an HTTP parameter, URL segment, or other user-controlled value that is used as the tag value in a <svelte:element> without prior sanitization.
3. Craft malicious payload: Construct a tag name string containing HTML injection characters, for example: div><script>alert(document.cookie)</script><div or similar payloads that break out of the element tag context.
4. Submit the payload: Send an HTTP request (GET or POST) to the SSR endpoint with the crafted value in the relevant parameter.
5. Observe injection: The server renders the HTML page with the unsanitized tag name embedded, causing the injected HTML/script to appear in the response body delivered to the victim's browser.
6. Achieve objective: The victim's browser parses and executes the injected script, enabling session theft, credential harvesting, or further attacks (GitHub Advisory, Svelte Security Advisory).

• Network: HTTP responses from the Svelte SSR server containing unexpected <script> tags, event handler attributes (e.g., onerror=, onload=), or malformed HTML element names in rendered pages.
• Logs: Web server access logs showing requests with URL-encoded or raw HTML special characters (<, >, ", ') in parameters that map to <svelte:element> tag values; unusual outbound connections from user browsers to attacker-controlled domains following page loads.
• File System: No direct file system artifacts expected for this injection type, as exploitation occurs at the HTTP response level.
• Process/Application: Application error logs showing unexpected tag name values being processed by the Svelte SSR renderer; Content Security Policy (CSP) violation reports triggered by injected inline scripts.

The vulnerability is fixed in svelte version 5.51.5. Operators should upgrade the svelte npm package to 5.51.5 or later as the primary remediation (GitHub Advisory, Red Hat Bugzilla). As a workaround prior to patching, developers should validate or allowlist tag name values before passing them to <svelte:element this={tag}> in SSR contexts, ensuring only known-safe HTML tag names are accepted. Implementing a strict Content Security Policy (CSP) can also reduce the impact of any successful HTML injection by blocking execution of injected scripts.

The vulnerability was discovered and reported by a researcher identified as elliott-with-the-longest-name-on-github and was published directly through the sveltejs/svelte GitHub repository's security advisory process on February 18, 2026. Red Hat tracked the issue via Bugzilla (Bug 2441520) and classified it as medium severity. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (GitHub Advisory, Red Hat Bugzilla).