Vulnerability · Published Apr 15, 2025 · Assigned by GitHub_M

CVE-2025-32388SvelteKit allows XSS via tracked search_params

Medium 5.4

In plain English

A medium-severity cross-site scripting in kit from sveltejs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 76.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL. This vulnerability is fixed in 2.20.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@sveltejs/kit	2.20.6	GHSA-6q87-84jw-cjhp

Affected products (as reported)

Vendor	Product	Versions
sveltejs	kit	>= 2.0.0, < 2.20.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/sveltejs/kit/security/advisories/GHSA-6q87-84jw-cjhp x_refsource_CONFIRM
https://github.com/sveltejs/kit/commit/d3300c6a67908590266c363dba7b0835d9a194cf x_refsource_MISC
https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.20.6 x_refsource_MISC