CVE-2026-27125

Katalog CVE

CVSS 6.8 · Medium EPSS 0,51%

Kerentanan Improperly Controlled Modification of Dynamically-Determined Object Attributes pada svelte. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.

Rincian

Terbit di NVD

20 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp advisory vendor
• https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f patch
• https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5 product · release notes