@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params

Description

Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.

Recommendation

Update the @sveltejs/kit package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0, < 2.20.6
• Patched version(s): 2.20.6

References

• GHSA-6q87-84jw-cjhp
• CVE-2025-32388
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message - CVE-2025-64758
• Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] (GHSA-963h-3v39-3pqf) - CVE-2025-27793
• jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin - CVE-2025-9910
• Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - CVE-2025-27793

Tags:

npm

@sveltejs/kit