What is GHSA-h7h7-mm68-gmrc?

GHSA-h7h7-mm68-gmrc is a security advisory published by GitHub Security Advisories with Medium severity. Svelte affected by XSS in SSR `\u003coption\u003e` element

Which CVE IDs does GHSA-h7h7-mm68-gmrc cover?

GHSA-h7h7-mm68-gmrc covers the following CVE IDs: CVE-2026-27119. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-h7h7-mm68-gmrc?

GHSA-h7h7-mm68-gmrc affects 1 product, including: npm/svelte:\u003e= 5.39.3, \u003c 5.51.5.

GHSA-h7h7-mm68-gmrcMedium

Svelte affected by XSS in SSR `<option>` element

Vendor

GitHub Security Advisories

Published

February 19, 2026

Last Modified

February 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-27119 →

📋 Description

In certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.

🎯 Affected products1

npm/svelte:>= 5.39.3, < 5.51.5

🔗 References (3)

https://github.com/sveltejs/svelte/security/advisories/GHSA-h7h7-mm68-gmrc
https://nvd.nist.gov/vuln/detail/CVE-2026-27119
https://github.com/advisories/GHSA-h7h7-mm68-gmrc