PT-2025-16545 · Sveltekit · Sveltekit

Kkarikos · Published 2025-04-14 · Updated 2026-01-08 · CVE-2025-32388

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SvelteKit versions prior to 2.20.6

Description The issue arises from unsanitized search param names, leading to an XSS vulnerability. This occurs when iterating over all entries of event.url.searchParams inside a server load function. Attackers can exploit this by crafting a malicious URL and getting a user to click on it.

Recommendations For versions prior to 2.20.6, update to version 2.20.6 to resolve the issue. As a temporary workaround, consider avoiding the iteration over all entries of event.url.searchParams inside server load functions until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-32388

GHSA-6Q87-84JW-CJHP

Affected Products

Sveltekit

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32388.json · Exploit
• https://osv.dev/vulnerability/GHSA-6q87-84jw-cjhp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32388 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32388 · Vendor Advisory
• https://github.com/sveltejs/kit · Note
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.20.6 · Note
• https://github.com/sveltejs/kit/security/advisories/GHSA-6q87-84jw-cjhp · Note
• https://github.com/sveltejs/kit/commit/d3300c6a67908590266c363dba7b0835d9a194cf · Note
• https://twitter.com/railsonmaui/status/2009119438495527195 · Twitter Post
• https://twitter.com/CVEnew/status/1912277384960655799 · Twitter Post
• https://t.me/cvetracker/21703 · Telegram Post
• https://t.me/cvedetector/23040 · Telegram Post