Description
Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0, < 2.20.6
- Patched version(s): 2.20.6
References
Could your website be exposed too?
SmartScanner can check your website for @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - vega - CVE-2025-27793
- Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - CVE-2025-27793
- jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin - CVE-2025-9910
- `vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648
You might also like:
See something that needs correcting? Let us knowUpdated April 16, 2025