Nixpkgs security tracker

Untriaged

Permalink CVE-2026-27119

created 1 month, 4 weeks ago

Svelte affected by XSS in SSR `<option>` element

svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.

References

https://github.com/sveltejs/svelte/security/advisories/GHSA-h7h7-mm68-gmrc x_refsource_CONFIRM

Affected products

svelte

==>= 5.39.3, < 5.51.5

Matching in nixpkgs

pkgs.svelte-check

Svelte code checker

nixos-unstable 4.3.1
- nixpkgs-unstable 4.3.1
- nixos-unstable-small 4.3.1
nixos-25.11 4.3.1
- nixos-25.11-small 4.3.1
- nixpkgs-25.11-darwin 4.3.1

pkgs.svelte-language-server

Language server (implementing the language server protocol) for Svelte

nixos-unstable 0.17.25
- nixpkgs-unstable 0.17.25
- nixos-unstable-small 0.17.25
nixos-25.11 0.17.21
- nixos-25.11-small 0.17.21
- nixpkgs-25.11-darwin 0.17.21

pkgs.vscode-extensions.svelte.svelte-vscode

Svelte language support for VS Code

nixos-unstable 109.13.0
- nixpkgs-unstable 109.13.0
- nixos-unstable-small 109.13.0
nixos-25.11 109.12.0
- nixos-25.11-small 109.12.0
- nixpkgs-25.11-darwin 109.12.0

pkgs.tree-sitter-grammars.tree-sitter-svelte

None

nixos-unstable 0.11.0
- nixpkgs-unstable 0.11.0
- nixos-unstable-small 0.11.0
nixos-25.11 0.25.10
- nixos-25.11-small 0.25.10
- nixpkgs-25.11-darwin 0.25.10

pkgs.vimPlugins.nvim-treesitter-parsers.svelte

None

nixos-unstable 0.0.0+rev=ae5199d
- nixpkgs-unstable 0.0.0+rev=ae5199d
- nixos-unstable-small 0.0.0+rev=ae5199d
nixos-25.11 -
- nixos-25.11-small
- nixpkgs-25.11-darwin