The vulnerability exists in the Svelte framework when rendering untrusted data as the initial value of a contenteditable element that uses bind:innerText or bind:textContent during server‑side rendering. Because the framework fails to escape the contents of these bindings, an attacker can inject malicious HTML, resulting in client‑side script execution. This is a typical web page injection flaw (CWE‑79) that allows an attacker to run arbitrary code in the browser, steal session data, deface the page, or perform other malicious actions against users of the affected site.

All installations of Svelte older than version 5.53.5 that render contenteditable elements with bind:innerText or bind:textContent on the server are affected. The issue applies to the sveltejs:svelte product as distributed through npm for Node.js environments.

The advisory assigns a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1%, reflecting a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that an attacker can supply untrusted data to the server’s rendering of a contenteditable field using the affected bindings. Upon rendering, the malicious payload will execute in the victim’s browser, providing typical XSS consequences.