svelte

Cybernetically enhanced web apps

Latest 5.57.2

91%

Total Score

healthy

Frequent releases and active organization-backed development make this a mature dependency, with a few high-confidence CI hygiene findings.

Are you affected? Scan for Free

Health Score Breakdown

Repo tooling

The project uses Vitest, npm scripts, and TypeScript for its build and test tooling. No security scanning tools were detected, a minor process gap that is partly offset by the repository's other controls.

Workflow audit

All four workflows use read-only permissions and all 27 action references are pinned, with no untrusted checkouts or script injection. However, two high-confidence unsound conditions and a high-confidence GitHub app with blanket installation permissions are workflow hygiene concerns.

Vulnerabilities

Title	Versions	Severity
CVE-2026-42573 svelte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 5.55.6.	0.0.0 - 5.55.6	Medium
CVE-2026-42567 svelte is vulnerable to Inefficient Regular Expression Complexity in versions 5.51.5 - 5.55.6.	5.51.5 - 5.55.6	Medium
CVE-2026-42599 svelte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 5.55.6.	0.0.0 - 5.55.6	Medium
CVE-2026-27902 svelte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 5.53.0 - 5.53.5.	5.53.0 - 5.53.5	Medium
CVE-2026-27901 svelte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 5.53.4.	0.0.0 - 5.53.4	Medium