{"schema":"threatline.record/2","record":{"id":"CVE-2025-32388","aliases":["GHSA-6q87-84jw-cjhp"],"summary":"@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params","details":"### Summary\n\nUnsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of `event.url.searchParams` inside a server `load` function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.\n\n### Details\n\nSvelteKit tracks which parameters in `event.url.searchParams` are read inside server `load` functions. If the application iterates over the these parameters, the `uses.search_params` array included in the boot script (embedded in the server-rendered HTML) will have any search param name included in unsanitized form.\n\n`packages/kit/src/runtime/server/utils.js:150` has the `stringify_uses(node)` function which prints these out.\n\n### Reproduction\n\nIn a `+page.server.js` or `+layout.server.js`:\n\n```js\n/** @type {import('@sveltejs/kit').Load} */\nexport function load(event) {\n  const values = {};\n\n  for (const key of event.url.searchParams.keys()) {\n    values[key] = event.url.searchParams.get(key);\n  }\n}\n```\n\nIf a user visits the page in question via a link containing `?</script/><script>window.pwned%3D1</script/>`, the `</script>` will be included verbatim in the payload, causing the embedded script to be executed.\n\nIt is not necessary to return the parameter value from `load` or render it in the page, only to read it (which causes it to be tracked as a dependency) while `load` is running.\n\n### Impact\n\nAny application that iterates over all values in `event.url.searchParams` in a `load` function in `+page.server.js` or `+layout.server.js` (directly or indirectly) is vulnerable to XSS.","categories":["Libraries & packages"],"product":"@sveltejs/kit","vendor":"sveltejs","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-6q87-84jw-cjhp","source_modified_at":"2026-10-18T15:04:06Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@sveltejs/kit"},"range":">= 2.0.0, < 2.20.6"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-32388","source_modified_at":"2025-04-16T13:33:47.383Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"kit","vendor":"sveltejs","versions":[{"status":"affected","version":">= 2.0.0, < 2.20.6"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6q87-84jw-cjhp","source_modified_at":"2025-04-16T00:40:49Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"@sveltejs/kit","ecosystem":"npm","purl":"pkg:npm/%40sveltejs/kit"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.20.6"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-6q87-84jw-cjhp","source_modified_at":"2026-10-18T15:04:06Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@sveltejs/kit"},"version":"2.20.6"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6q87-84jw-cjhp","source_modified_at":"2025-04-16T00:40:49Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"@sveltejs/kit","ecosystem":"npm","purl":"pkg:npm/%40sveltejs/kit"},"version":"2.20.6"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00304,"percentile":0.22008,"score_date":"2026-10-23"},"published_at":"2025-04-15T22:32:06.059Z","modified_at":"2026-10-18T15:04:06Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-6q87-84jw-cjhp","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-18T15:04:06Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-32388","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2025-04-16T13:33:47.383Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-6q87-84jw-cjhp","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2025-04-16T00:40:49Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32388","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-6q87-84jw-cjhp","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/sveltejs/kit/commit/d3300c6a67908590266c363dba7b0835d9a194cf","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.20.6","tags":["x_refsource_MISC"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32388","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-6q87-84jw-cjhp","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2025-04-16T13:33:24.850741Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-18T15:04:06Z","content_hash":"0560e606e47ccde76b5ea7ffe4f4249b20e7679ed9a25c079a245f85abf64691"}}