Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL. This vulnerability is fixed in 2.20.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | kit | >= 2.0.0, < 2.20.6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @sveltejs/kit | >= 2.0.0, < 2.20.6 | 2.20.6 | GHSA-6q87-84jw-cjhp |