What is the CVSS score of CVE-2026-27125?

CVE-2026-27125 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Svelte are affected by CVE-2026-27125?

CVE-2026-27125 presents notable security risk rated CVSS 6.8. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-27125?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Svelte CVE-2026-27125

MEDIUM

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-02-20 security-advisories@github.com

GHSA-crpf-4hrx-3jrp

Code Injection Red Hat Svelte

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Red Hat

5.6 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

Patch released

Feb 23, 2026 - 20:52 nvd

Patch available

CVE Published

Feb 20, 2026 - 23:16 nvd

MEDIUM 6.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on svelte (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.51.5.

DescriptionGitHub Advisory

svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted - a precondition outside of Svelte's control - this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.

AnalysisAI

Svelte versions prior to 5.51.5 improperly enumerate prototype chain properties during server-side rendering attribute spreading, allowing polluted Object.prototype properties to inject unexpected attributes into SSR output or cause rendering errors. This vulnerability affects applications using SSR where the prototype chain has been previously manipulated, though client-side rendering is unaffected. The issue requires prototype pollution as a precondition but can lead to information disclosure or denial of service in vulnerable SSR environments.

Technical ContextAI

This vulnerability (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes) affects Svelte. svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerabilit