Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4371-nuun-bybx
Vulnerability ID VCID-4371-nuun-bybx
Aliases CVE-2026-27125
GHSA-crpf-4hrx-3jrp
Summary Svelte SSR attribute spreading includes inherited properties from prototype chain In server-side rendering, attribute spreading on elements (e.g. `<div {...attrs}>`) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where `Object.prototype` has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27125.json
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2026-27125
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-crpf-4hrx-3jrp
cvssv4 5.3 https://github.com/sveltejs/svelte
generic_textual MODERATE https://github.com/sveltejs/svelte
cvssv4 5.3 https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f
generic_textual MODERATE https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f
ssvc Track https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f
cvssv4 5.3 https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5
generic_textual MODERATE https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5
ssvc Track https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5
cvssv3.1_qr MODERATE https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp
cvssv4 5.3 https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp
generic_textual MODERATE https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp
ssvc Track https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp
cvssv4 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-27125
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-27125
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27125.json
https://api.first.org/data/v1/epss?cve=CVE-2026-27125
https://github.com/sveltejs/svelte
https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f
https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5
2441511 https://bugzilla.redhat.com/show_bug.cgi?id=2441511
CVE-2026-27125 https://nvd.nist.gov/vuln/detail/CVE-2026-27125
GHSA-crpf-4hrx-3jrp https://github.com/advisories/GHSA-crpf-4hrx-3jrp
GHSA-crpf-4hrx-3jrp https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27125.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N Found at https://github.com/sveltejs/svelte
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N Found at https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-25T21:33:01Z/ Found at https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N Found at https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-25T21:33:01Z/ Found at https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N Found at https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-25T21:33:01Z/ Found at https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-27125
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.09165
EPSS Score 0.0003
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:06:42.836327+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/svelte/CVE-2026-27125.yml 38.6.0