Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Svelte bug bounty programs

svelte.dev Updated

Svelte runs one public program: a Sorona bug bounty paying up to $6,000.

Top reward
$6,000
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Svelte runs.

  • Svelte

    Sorona · Bug bounty

    Open

    Top reward

    $6,000
    Critical
    –
    High
    $6,000
    Medium
    $1,250
    Low
    $625
    Safe harbor
    Partial
    First response
    24 hours promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 8 excluded.

  • https://svelte.dev

    Web

  • Client-side code generation, covering DOM updates, event wiring, actions, transitions and {@html} handling

    Products and areas

  • Server-side code generation and the escaping helpers the generated output calls in text, attribute, style and script contexts

    Products and areas

  • SvelteKit at Tier 2: routing, the handle and handleFetch hooks, form actions, remote functions, the CSRF and origin checks, and the request handling in the official adapters

    Products and areas

  • SvelteKit's server-only module isolation at Tier 2, the mechanism that keeps $lib/server and *.server.js code out of a public bundle

    Products and areas

  • The client runtime and reactivity system, including runes, stores and the effect graph

    Products and areas

  • The compiler front end: template parsing, the analysis pass, and the way markup, expressions and directives become an internal representation

    Products and areas

  • The public compiler API that build tools, adapters and downstream frameworks consume

    Products and areas

  • The sveltejs/svelte repository itself, listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. SvelteKit is in scope too, at Tier 2, where a critical is capped at $5,000

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 8

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Archived repositories and end-of-life versions that are no longer maintained

  • Examples, templates and documentation snippets rather than the compiler or framework code

  • Handle-hook authorization bypass via percent-encoded pathnames where the developer chose to compare raw path strings themselves

  • Prototype pollution in SSR internals reported without a full chain to concrete impact

  • Reports without the mandatory working proof-of-concept zip, which are not eligible regardless of severity

  • The Tier 1 ceiling on anything SvelteKit-specific: that asset is capped at $5,000 for a critical, so a SvelteKit finding cannot reach the compiler's $10,000 row

  • Third-party dependency CVEs without a demonstrated end-to-end chain through Svelte or SvelteKit

  • x-sveltekit-pathname header spoofing, unless you can show the framework itself trusts that header

Recent changes

Reward and scope changes across every Svelte program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Svelte products, from the NVD.

Search NVD
  • CVE-2026-82257 Medium

    SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.

  • CVE-2026-82258 Medium

    SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.

  • CVE-2026-82259 High

    SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arr

  • CVE-2026-82260 High

    SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.

  • CVE-2026-82261 High

    SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.

  • CVE-2026-82256 Medium

    SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.

  • CVE-2026-42599 Medium

    Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability

  • CVE-2026-42567 Medium

    Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.

About this page

This page gathers every public program listed under svelte.dev: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.