CVE-2025-32388: SvelteKit XSS Vulnerability

CVE-2025-32388 Overview

CVE-2025-32388 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in SvelteKit, a framework for building web applications with Svelte. Versions prior to 2.20.6 fail to sanitize search parameter names before rendering. Applications become vulnerable when a server load function iterates over all entries of event.url.searchParams. An attacker crafts a malicious URL containing script payloads as parameter names and lures a victim to click the link, resulting in script execution in the victim's browser context. The issue is fixed in SvelteKit 2.20.6.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting, and unauthorized actions performed as the authenticated user.

Affected Products

SvelteKit versions prior to 2.20.6
Applications using event.url.searchParams iteration inside server load functions
Downstream Svelte-based web applications relying on affected SvelteKit builds

Discovery Timeline

2025-04-15 - CVE-2025-32388 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32388

Vulnerability Analysis

The flaw is a reflected XSS in SvelteKit's server-side data handling. When a server load function enumerates entries from event.url.searchParams, SvelteKit serializes those key-value pairs into the rendered HTML response. The framework sanitizes parameter values but does not sanitize parameter names. An attacker inserts HTML or JavaScript payloads directly into the query string parameter names, which SvelteKit then reflects into the page without escaping.

Exploitation requires user interaction because the attacker must convince the victim to click a crafted URL. Once rendered, the injected script executes in the origin of the vulnerable application and can access cookies, tokens, and DOM state accessible to that origin.

Root Cause

The root cause is missing output encoding for search parameter names during server-side rendering serialization. The fix in commit d3300c6a67908590266c363dba7b0835d9a194cf replaces the internal stringify_uses helper with a serialize_uses implementation that properly escapes untrusted string content before it is emitted into the HTML payload.

Attack Vector

The attack is delivered over the network through a crafted URL. An adversary constructs a link where a query parameter name contains an XSS payload, then distributes the link through phishing, chat, forums, or malicious redirects. When the victim opens the URL in a browser, the vulnerable SvelteKit server iterates the parameters, embeds the poisoned name into the response, and the browser executes the payload.

javascript

// Security patch excerpt from packages/kit/src/runtime/server/data/index.js
 import { normalize_error } from '../../../utils/error.js';
 import { once } from '../../../utils/functions.js';
 import { load_server_data } from '../page/load_data.js';
-import { clarify_devalue_error, handle_error_and_jsonify, stringify_uses } from '../utils.js';
+import { clarify_devalue_error, handle_error_and_jsonify, serialize_uses } from '../utils.js';
 import { normalize_path } from '../../../utils/url.js';
 import { text } from '../../../exports/index.js';
 import * as devalue from 'devalue';

Source: SvelteKit GitHub Commit d3300c6

The patch swaps the unsafe stringify_uses helper for serialize_uses, which applies proper encoding to values injected into rendered output, including keys derived from URL search parameters.

Detection Methods for CVE-2025-32388

Indicators of Compromise

Web server access logs containing query string parameter names with HTML tags, angle brackets, script, onerror, or javascript: substrings
HTTP referrers pointing to external phishing domains delivering crafted SvelteKit application URLs
Client-side error reports or CSP violations originating from application pages that ingest URL search parameters

Detection Strategies

Grep SvelteKit source code for iterations such as for (const [key, value] of url.searchParams) inside +page.server.js, +layout.server.js, and +server.js files
Deploy a Content Security Policy that blocks inline script execution to detect and constrain reflected XSS attempts
Run dynamic application security testing (DAST) with payloads placed in parameter names, not only values

Monitoring Recommendations

Alert on web application firewall (WAF) rules triggered by suspicious characters within query parameter keys
Monitor browser telemetry for unexpected script origins and CSP report-uri submissions from production hosts
Track SvelteKit dependency versions in software bills of materials (SBOMs) and flag any release below 2.20.6

How to Mitigate CVE-2025-32388

Immediate Actions Required

Upgrade SvelteKit to version 2.20.6 or later across all production and staging environments
Audit every server load function and API route handler that reads event.url.searchParams for unsafe iteration patterns
Rotate any session tokens or credentials that may have been exposed if suspicious traffic is identified in logs

Patch Information

The vulnerability is fixed in SvelteKit 2.20.6. Details are available in the SvelteKit 2.20.6 Release Notes and the GHSA-6q87-84jw-cjhp Security Advisory. Update the @sveltejs/kit dependency in package.json and rebuild the application.

Workarounds

Avoid iterating over event.url.searchParams entries; instead, read only known parameter names using searchParams.get('name')
Explicitly encode or validate parameter keys with an allowlist before returning them from load functions
Enforce a strict Content Security Policy that disallows inline scripts to reduce XSS impact until patching is complete

bash

# Update SvelteKit to the patched version
npm install @sveltejs/kit@2.20.6

# Verify installed version
npm ls @sveltejs/kit

# Rebuild and redeploy the application
npm run build