{"items":[{"id":"NVI-00011841","kind":"vulnerability","title":"@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6q87-84jw-cjhp","CVE-2025-32388"],"plain_summary":"GitHub lists this reviewed advisory for @sveltejs/kit. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-133347f01097a0623da43cb75fd6dfb8"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-18T15:04:06.000Z","value":"5.4 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-41eb7e87c876658ba9ed2515075030d1"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.304%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.23214. Missing scores are unknown.","source_id":"sr-133347f01097a0623da43cb75fd6dfb8"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-41eb7e87c876658ba9ed2515075030d1","url":"https://github.com/advisories/GHSA-6q87-84jw-cjhp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6q87-84jw-cjhp","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:14.588Z"},{"id":"sr-133347f01097a0623da43cb75fd6dfb8","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2025-32388","publisher":"FIRST EPSS","observed_at":"2026-11-01T01:39:43.058Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-41eb7e87c876658ba9ed2515075030d1"],"technology":"@sveltejs/kit","known_exclusions":[],"conditions_summary":"### Summary\n\nUnsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of `event.url.searchParams` inside a server `load` function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.\n\n### Details\n\nSvelteKit tracks which parameters in `event.url.searchParams` are read inside server `load` functions. If the application iterates over the these parameters, the `uses.search_params` array included in the boot script (embedded in the server-rendered HTML) will have any search param name included in unsanitized form.\n\n`packages/kit/src/runtime/server/utils.js:150` has the `stringify_uses(node)` function which prints these out.\n\n### Reproduction\n\nIn a `+page.server.js` or `+layout.server.js`:\n\n```js\n/** @type {import('@sveltejs/kit').Load} */\nexport function load(event) {\n  const values = {};\n\n  for (const key of event.url.searchParams.keys()) {\n    values[key] = event.url.searchParams.get(key);\n  }\n}\n```\n\nIf a user visits the page in question via a link containing `?window.pwned%3D1`, the `` will be included verbatim in the payload, causing the embedded sc","public_affected_ranges":[">= 2.0.0, < 2.20.6"]}],"null_published_at":"2026-11-01T14:34:14.099Z","source_updated_at":"2026-10-18T15:04:06.000Z","source_disclosed_at":"2025-04-14T19:10:42.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T23:14:14.588Z"},{"id":"NVI-00011841","kind":"vulnerability","title":"@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6q87-84jw-cjhp","CVE-2025-32388"],"plain_summary":"GitHub lists this reviewed advisory for @sveltejs/kit. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-41eb7e87c876658ba9ed2515075030d1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-18T15:04:06.000Z","value":"5.4 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-41eb7e87c876658ba9ed2515075030d1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-41eb7e87c876658ba9ed2515075030d1","url":"https://github.com/advisories/GHSA-6q87-84jw-cjhp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6q87-84jw-cjhp","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:14.588Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-41eb7e87c876658ba9ed2515075030d1"],"technology":"@sveltejs/kit","known_exclusions":[],"conditions_summary":"### Summary\n\nUnsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of `event.url.searchParams` inside a server `load` function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.\n\n### Details\n\nSvelteKit tracks which parameters in `event.url.searchParams` are read inside server `load` functions. If the application iterates over the these parameters, the `uses.search_params` array included in the boot script (embedded in the server-rendered HTML) will have any search param name included in unsanitized form.\n\n`packages/kit/src/runtime/server/utils.js:150` has the `stringify_uses(node)` function which prints these out.\n\n### Reproduction\n\nIn a `+page.server.js` or `+layout.server.js`:\n\n```js\n/** @type {import('@sveltejs/kit').Load} */\nexport function load(event) {\n  const values = {};\n\n  for (const key of event.url.searchParams.keys()) {\n    values[key] = event.url.searchParams.get(key);\n  }\n}\n```\n\nIf a user visits the page in question via a link containing `?window.pwned%3D1`, the `` will be included verbatim in the payload, causing the embedded sc","public_affected_ranges":[">= 2.0.0, < 2.20.6"]}],"null_published_at":"2026-11-01T01:03:56.609Z","source_updated_at":"2026-10-18T15:04:06.000Z","source_disclosed_at":"2025-04-14T19:10:42.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:14:14.588Z"}],"next_cursor":null,"snapshot_revision":"42594"}