CVE-2025-32388

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL. This vulnerability is fixed in 2.20.6.

• CWE-79

• https://github.com/sveltejs/kit/commit/d3300c6a67908590266c363dba7b0835d9a194cf
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.20.6
• https://github.com/sveltejs/kit/security/advisories/GHSA-6q87-84jw-cjhp

Published

Apr 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32381XGrammar is an open-source library for efficient, flexible, …6.5
• CVE-2025-32382Metabase is an open source Business Intelligence and Embedde…1.8
• CVE-2025-32383MaxKB (Max Knowledge Base) is an open source knowledge base …7.2
• CVE-2025-32385EspoCRM is an Open Source Customer Relationship Management s…6.5
• CVE-2025-32386Helm is a tool for managing Charts. A chart archive file can…6.5
• CVE-2025-32387Helm is a package manager for Charts for Kubernetes. A JSON …6.5
• CVE-2025-32389NamelessMC is a free, easy to use & powerful website softwar…6.5
• CVE-2025-3239A vulnerability classified as critical was found in PHPGuruk…9.8
• CVE-2025-32390EspoCRM is a free, open-source customer relationship managem…8.5
• CVE-2025-32391HedgeDoc is an open source, real-time, collaborative, markdo…4.6
• CVE-2025-32392AutoGPT is a workflow automation platform for creating, depl…8.7
• CVE-2025-32393AutoGPT is a platform that allows users to create, deploy, a…6.5