A server‑side rendering feature in Svelte allows dynamic element tags via `<svelte:element this={tag}>`. Before version 5.51.5 the framework does not validate or sanitize the tag string, so an attacker can craft a tag value containing malicious characters that end up in the generated HTML, enabling HTML injection or cross‑site scripting in the rendered page. The weakness aligns with CWE‑1286 (Improper Validation of Input or Parameters) and CWE‑79 (Cross‑Site Scripting), illustrating that the lack of input validation leads to an XSS vulnerability.

The vulnerability affects the Svelte framework released by sveltejs:svelte and applies to all versions prior to 5.51.5 when the SSR mode is used. Client‑side rendering is not impacted and the issue does not affect earlier releases of Node.js or other dependencies that rely on Svelte.

The assessment assigns a CVSS score of 5.1, indicating moderate severity, and an EPSS of less than 1%, suggesting a low probability of exploitation in the wild. Because the vulnerability is not listed in the CISA KEV catalog, no widespread exploitation campaigns are currently documented. The likely attack vector is server‑side rendering of untrusted content; an attacker would need to supply a malicious tag string that the application uses with `<svelte:element>`, which then appears in the HTML response delivered to users, potentially leading to XSS. No prerequisites beyond supplying input to the SSR endpoint are indicated by the description.