Nixpkgs security tracker

Untriaged

Permalink CVE-2026-27122

created 1 month, 4 weeks ago

Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.

References

https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp x_refsource_CONFIRM

Affected products

svelte

==< 5.51.5

Matching in nixpkgs

pkgs.svelte-check

Svelte code checker

nixos-unstable 4.3.1
- nixpkgs-unstable 4.3.1
- nixos-unstable-small 4.3.1
nixos-25.11 4.3.1
- nixos-25.11-small 4.3.1
- nixpkgs-25.11-darwin 4.3.1

pkgs.svelte-language-server

Language server (implementing the language server protocol) for Svelte

nixos-unstable 0.17.25
- nixpkgs-unstable 0.17.25
- nixos-unstable-small 0.17.25
nixos-25.11 0.17.21
- nixos-25.11-small 0.17.21
- nixpkgs-25.11-darwin 0.17.21

pkgs.vscode-extensions.svelte.svelte-vscode

Svelte language support for VS Code

nixos-unstable 109.13.0
- nixpkgs-unstable 109.13.0
- nixos-unstable-small 109.13.0
nixos-25.11 109.12.0
- nixos-25.11-small 109.12.0
- nixpkgs-25.11-darwin 109.12.0

pkgs.tree-sitter-grammars.tree-sitter-svelte

None

nixos-unstable 0.11.0
- nixpkgs-unstable 0.11.0
- nixos-unstable-small 0.11.0
nixos-25.11 0.25.10
- nixos-25.11-small 0.25.10
- nixpkgs-25.11-darwin 0.25.10

pkgs.vimPlugins.nvim-treesitter-parsers.svelte

None

nixos-unstable 0.0.0+rev=ae5199d
- nixpkgs-unstable 0.0.0+rev=ae5199d
- nixos-unstable-small 0.0.0+rev=ae5199d
nixos-25.11 -
- nixos-25.11-small
- nixpkgs-25.11-darwin