---
id: "CVE-2025-32388"
kind: "vulnerability"
aliases: ["CVE-2025-32388", "GHSA-6q87-84jw-cjhp"]
title: "@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params"
severity: "medium"
cvss: 5.400000095367432
epss: 0.0030400000978261232
exploited: false
status: "open"
category: "package"
products: [{"name": "@sveltejs/kit", "fixed": ["2.20.6"], "affected": ">= 2.0.0, < 2.20.6", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-79", "next.js", "package", "sveltekit"]
not_affected_if: ["no-server-load-iterating-searchparams", "pinned-below-2.0.0", "static-export"]
published_at: "2025-04-14T19:10:42+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:48:50+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-6q87-84jw-cjhp", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32388", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params

SvelteKit embeds unsanitized search parameter names in the page's boot script when a server load function iterates over all of event.url.searchParams. An attacker who gets a user to open a crafted link can run arbitrary JavaScript in that user's browser on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@sveltejs/kit affected >= 2.0.0, < 2.20.6 fixed 2.20.6

## How to check

Search server load functions in +page.server.js and +layout.server.js for iteration over event.url.searchParams (keys(), entries(), forEach, for...of).
Check the installed version: npm ls @sveltejs/kit

## Fix

Upgrade @sveltejs/kit to 2.20.6 or later.
Until upgraded, avoid iterating over all searchParams entries in server load functions.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-6q87-84jw-cjhp
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-32388

## From the sources

### Summary

Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of `event.url.searchParams` inside a server `load` function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.

### Details

SvelteKit tracks which parameters in `event.url.searchParams` are read inside server `load` functions. If the application iterates over the these parameters, the `uses.search_params` array included in the boot script (embedded in the server-rendered HTML) will have any search param name included in unsanitized form.

`packages/kit/src/runtime/server/utils.js:150` has the `stringify_uses(node)` function which prints these out.

### Reproduction

In a `+page.server.js` or `+layout.server.js`:

```js
/** @type {import('@sveltejs/kit').Load} */
export function load(event) {
  const values = {};

  for (const key of event.url.searchParams.keys()) {
    values[key] = event.url.searchParams.get(key);
  }
}
```

If a user visits the page in question via a link containing `?</script/><script>window.pwned%3D1</script/>`, the `</script>` will be included verbatim in the payload, causing the embedded script to be executed.

It is not necessary to return the parameter value from `load` or render it in the page, only to read it (which causes it to be tracked as a dependency) while `load` is running.

### Impact

Any application that iterates over all values in `event.url.searchParams` in a `load` function in `+page.server.js` or `+layout.server.js` (directly or indirectly) is vulnerable to XSS.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_