A flaw in Svelte’s server‑side rendering engine causes an <option> element’s content to be written without proper escaping, enabling an attacker to inject arbitrary HTML or JavaScript into the rendered page. This is a typical reflected XSS vulnerability (CWE‑79) that can compromise the confidentiality, integrity, or availability of client side code when the injection is executed in the browser.

The vulnerability affects the Svelte framework for the JavaScript runtime environment, specifically versions from 5.39.3 through 5.51.4 inclusive. Svelte is used to build web applications that often rely on Node.js for server‑side rendering. The issue is present only in server‑side rendering; client‑side rendering remains unaffected.

According to the CVSS score of 5.1, the vulnerability has medium severity. The EPSS score of less than 1% indicates a low probability of exploitation at the current time, and it is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. However, attackers could construct malicious <option> content that is rendered during SSR, resulting in client‑side XSS if the application accepts untrusted input for option elements. The likely attack vector is a server route that renders <option> elements with data supplied by an external source without proper sanitization.