Svelte

Svelte is tracked by BlackTree as a software framework or development platform. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.

Lifecycle status

No support or retirement date is shown unless BlackTree can link it to a registered publisher source. A missing date means that a boundary is not publicly stated, has not yet been extracted, or still needs source routing. It does not mean the product is supported indefinitely.

Product overview

Main capabilities

Application development components
Versioned runtime or build interfaces
Security and compatibility maintenance

Typical use

Used by software teams to build, run or maintain applications.

Deployment

Included in source projects, application dependencies, build systems or managed runtimes.

Lifecycle records

No verified lifecycle boundary is currently published for this product family.

Official sources

MANUAL

Svelte official lifecycle source

Registered for manual verification because unattended extraction is unavailable or inappropriate.

Open publisher source

Package vulnerability advisories

CVE-2026-27901

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

Fixed: 5.53.5

CVE-2026-27122

Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

Fixed: 5.51.5

CVE-2026-27125

Svelte SSR attribute spreading includes inherited properties from prototype chain

Fixed: 5.51.5

CVE-2026-27121

Svelte affected by cross-site scripting via spread attributes in Svelte SSR

Fixed: 5.51.5

CVE-2022-25875

Svelte vulnerable to XSS when using objects during server-side rendering

Fixed: 3.49.0

CVE-2026-42573

Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

Fixed: 5.55.7

CVE-2026-42599

Svelte SSR vulnerable to cross-site scripting via spread attributes

Fixed: 5.55.7

CVE-2026-42567

Svelte: ReDoS in `<svelte:element>` Tag Validation

Fixed: 5.55.7