Skip to content

Chore: Update @sveltejs/kit to v2.20.6 [SECURITY] #182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 6, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@sveltejs/kit (source) 2.20.5 -> 2.20.6 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-32388

Summary

Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.

Details

SvelteKit tracks which parameters in event.url.searchParams are read inside server load functions. If the application iterates over the these parameters, the uses.search_params array included in the boot script (embedded in the server-rendered HTML) will have any search param name included in unsanitized form.

packages/kit/src/runtime/server/utils.js:150 has the stringify_uses(node) function which prints these out.

Reproduction

In a +page.server.js or +layout.server.js:

/** @​type {import('@​sveltejs/kit').Load} */
export function load(event) {
  const values = {};

  for (const key of event.url.searchParams.keys()) {
    values[key] = event.url.searchParams.get(key);
  }
}

If a user visits the page in question via a link containing ?</script/><script>window.pwned%3D1</script/>, the </script> will be included verbatim in the payload, causing the embedded script to be executed.

It is not necessary to return the parameter value from load or render it in the page, only to read it (which causes it to be tracked as a dependency) while load is running.

Impact

Any application that iterates over all values in event.url.searchParams in a load function in +page.server.js or +layout.server.js (directly or indirectly) is vulnerable to XSS.


Release Notes

sveltejs/kit (@​sveltejs/kit)

v2.20.6

Compare Source

Patch Changes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

changeset-bot bot commented Aug 6, 2024

⚠️ No Changeset found

Latest commit: 04e63c0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate renovate bot force-pushed the renovate/dev/npm-sveltejs-kit-vulnerability branch from 79e65b7 to 1a4f721 Compare November 25, 2024 19:33
@renovate renovate bot changed the title Chore: Update @sveltejs/kit to v2.4.3 [SECURITY] Chore: Update @sveltejs/kit to v2.8.3 [SECURITY] Nov 25, 2024
@renovate renovate bot force-pushed the renovate/dev/npm-sveltejs-kit-vulnerability branch from 1a4f721 to d932dfd Compare February 2, 2025 22:27
@renovate renovate bot force-pushed the renovate/dev/npm-sveltejs-kit-vulnerability branch from d932dfd to 49e53d9 Compare February 11, 2025 16:10
@renovate renovate bot force-pushed the renovate/dev/npm-sveltejs-kit-vulnerability branch from 49e53d9 to fc6fad0 Compare April 14, 2025 23:38
@renovate renovate bot changed the title Chore: Update @sveltejs/kit to v2.8.3 [SECURITY] Chore: Update @sveltejs/kit to v2.20.6 [SECURITY] Apr 14, 2025
@renovate renovate bot force-pushed the renovate/dev/npm-sveltejs-kit-vulnerability branch from fc6fad0 to 04e63c0 Compare April 17, 2025 21:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants