@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params

Description

Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.

Recommendation

Update the @sveltejs/kit package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0, < 2.20.6
• Patched version(s): 2.20.6

References

• GHSA-6q87-84jw-cjhp
• CVE-2025-32388
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
• `vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648
• uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) - CVE-2022-0086
• cookie accepts cookie name, path, and domain with out of bounds characters - CVE-2024-47764

Tags:

npm

@sveltejs/kit