Security readout for executives and security teams
Plain-English summary
CVE-2026-27902 is a Svelte cross-site scripting risk in specific 5.53.x versions. If an application’s server-side rendering error handling returns attacker-controlled text through transformError, Svelte could place it into HTML without correct escaping. This could let malicious content run in a user’s browser. The vendor fixed it in Svelte 5.53.5.
Executive priority
Treat this as a targeted dependency update, not an emergency unless affected Svelte SSR applications process untrusted error content. Patch during the next standard web application maintenance window, with higher priority for public-facing services.
Technical view
Affected Svelte versions >=5.53.0 and <5.53.5 did not correctly escape transformError errors before embedding them in SSR HTML output, specifically around error boundary hydration markers. The issue is classified as CWE-79 with CVSS 4.0 score 5.3. Exploitability depends on attacker-controlled content reaching transformError and user interaction/presence per the vector.
Likely exposure
Exposure is limited to applications using Svelte versions 5.53.0 through 5.53.4, especially SSR paths with error boundaries and transformError behavior that can include attacker-controlled content. Applications on Svelte 5.53.5 or later are identified as fixed by the vendor.
Exploitation context
The sources do not report active exploitation, and the CVE is not marked as KEV. The CVSS vector indicates network reachability, high attack complexity, required attack conditions, no privileges, and user presence. Practical risk depends on application-specific error handling and whether untrusted data can be returned from transformError.
Researcher notes
Key conditions are Svelte 5.53.0-5.53.4, SSR HTML generation, error boundary hydration markers, and transformError output containing attacker-controlled content. The public sources identify the fix commit and 5.53.5 release but do not provide evidence of exploitation in the wild.
Mitigation direction
- Upgrade Svelte to version 5.53.5 or later.
- Review transformError implementations for attacker-controlled returned content.
- Follow the GitHub advisory and release notes for vendor guidance.
- Prioritize internet-facing SSR applications using affected Svelte versions.
Validation and detection
- Inventory Svelte package versions across applications and lockfiles.
- Confirm no deployed application uses Svelte 5.53.0 through 5.53.4.
- Identify SSR routes using error boundaries and transformError.
- Verify production builds run Svelte 5.53.5 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27902 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/sveltejs/svelte/security/advisories/GHSA-qgvg-pr8v-6rr3CVE reference · x_refsource_CONFIRM
- https://github.com/sveltejs/svelte/commit/0298e979371bb583855c9810db79a70a551d22b9CVE reference · x_refsource_MISC
- https://github.com/sveltejs/svelte/releases/tag/svelte%405.53.5CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.