https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T05:02:03.493938+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-270814 EUVD-2026-270814 2026-10-07T05:02:03.496258+00:00 EUVD-2026-270814 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27901 fkie_cve-2026-27901 2026-10-07T05:02:03.496292+00:00

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-phwv-c562-gvmh GHSA-phwv-c562-gvmh — Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` 2026-10-07T05:02:03.496324+00:00

Affected: npm: svelte

The contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server.