Description
“Unsanitized input from the request URL flows into end, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).”
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.8.3
- Patched version(s): 2.8.3
References
Could your website be exposed too?
SmartScanner can check your website for @sveltejs/kit vulnerable to XSS on dev mode 404 page and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @sveltejs/kit has unescaped error message included on error page - CVE-2024-53262
- @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params - CVE-2025-32388
- Webrecorder packages are vulnerable to XSS through 404 error handling logic - CVE-2025-58765
- Webrecorder packages are vulnerable to XSS through 404 error handling logic - @webrecorder/wabac - CVE-2025-58765
You might also like:
See something that needs correcting? Let us knowUpdated January 22, 2025