This PR contains the following updates:

Package	Change	Age	Confidence
@sveltejs/kit (source)	2.20.5 ->2.20.6

GitHub Vulnerability Alerts

CVE-2025-32388

Summary

Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries ofevent.url.searchParams inside a serverload function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.

Details

SvelteKit tracks which parameters inevent.url.searchParams are read inside serverload functions. If the application iterates over the these parameters, theuses.search_params array included in the boot script (embedded in the server-rendered HTML) will have any search param name included in unsanitized form.

packages/kit/src/runtime/server/utils.js:150 has thestringify_uses(node) function which prints these out.

Reproduction

In a+page.server.js or+layout.server.js:

/** @​type {import('@​sveltejs/kit').Load} */exportfunctionload(event){constvalues={};for(constkeyofevent.url.searchParams.keys()){values[key]=event.url.searchParams.get(key);}}

If a user visits the page in question via a link containing?</script/><script>window.pwned%3D1</script/>, the</script> will be included verbatim in the payload, causing the embedded script to be executed.

It is not necessary to return the parameter value fromload or render it in the page, only to read it (which causes it to be tracked as a dependency) whileload is running.

Impact

Any application that iterates over all values inevent.url.searchParams in aload function in+page.server.js or+layout.server.js (directly or indirectly) is vulnerable to XSS.

Release Notes

Configuration

📅Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦Automerge: Enabled.

♻Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated byMend Renovate. View therepository job log.