{"id":"CVE-2026-27125","aliases":["GHSA-crpf-4hrx-3jrp"],"url":"https://o3.security/vulnerability/CVE-2026-27125","summary":"Svelte SSR attribute spreading includes inherited properties from prototype chain","details":"svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.","published":"2026-02-20T22:29:45.364Z","modified":"2026-07-15T01:49:20.222568934Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"svelte","fixedVersion":"5.51.5"}],"fix":{"url":"https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f","label":"sveltejs/svelte@73098bb"},"references":[{"type":"WEB","url":"https://github.com/sveltejs/svelte/releases/tag/svelte@5.51.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27125.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/svelte/security/advisories/GHSA-crpf-4hrx-3jrp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27125"},{"type":"FIX","url":"https://github.com/sveltejs/svelte/commit/73098bb26c6f06e7fd1b0746d817d2c5ee90755f"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:49:20.222568934Z"}}