This vulnerability exists in the Svelte framework when server‑side rendering errors are processed by transformError. The error string returned by transformError is inserted into the HTML output without escaping, allowing an attacker‑controlled string to inject malicious markup or JavaScript. The flaw is a classic XSS that falls under CWE‑79 and can compromise the integrity and confidentiality of a user’s session.

Any project that uses the open‑source Svelte framework older than version 5.53.5 is vulnerable. The product is identified as sveltejs:svelte; updating to 5.53.5 or newer eliminates the issue.

The CVSS score of 5.3 indicates a moderate risk, while the EPSS score of <1% suggests that a publicly available exploit is unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker to cause Svelte to surface an error containing attacker‑controlled content, such as by manipulating user input processed by a transformError function or by exploiting a bug that feeds unsanitized data to transformError.