@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params

Description

Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.

Recommendation

Update the @sveltejs/kit package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0, < 2.20.6
• Patched version(s): 2.20.6

References

• GHSA-6q87-84jw-cjhp
• CVE-2025-32388
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• cookie accepts cookie name, path, and domain with out of bounds characters - CVE-2024-47764
• @sveltejs/kit vulnerable to XSS on dev mode 404 page - CVE-2024-53261
• @sveltejs/kit has unescaped error message included on error page - CVE-2024-53262
• Strapi's field level permissions not being respected in relationship title - CVE-2023-37263

Tags:

npm

@sveltejs/kit