{"action":"Upgrade @sveltejs/kit to 2.20.6 or later.","affected":[{"fixed":"2.20.6","introduced":"2.0.0"}],"component":"@sveltejs/kit","cve_ids":["CVE-2025-32388"],"ecosystem":"npm","epss":0.00304,"exploited":false,"fixed_versions":["2.20.6"],"ghsa_id":"GHSA-6q87-84jw-cjhp","id":"tcs_01M5KF7PWSPJTHSXAC3PSGE9BW","modified_at":"2025-04-16T00:40:49Z","published_at":"2025-04-14T19:10:42Z","references":["https://osv.dev/vulnerability/GHSA-6q87-84jw-cjhp","https://github.com/sveltejs/kit/security/advisories/GHSA-6q87-84jw-cjhp","https://nvd.nist.gov/vuln/detail/CVE-2025-32388","https://github.com/sveltejs/kit/commit/d3300c6a67908590266c363dba7b0835d9a194cf","https://github.com/sveltejs/kit","https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.20.6"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-6q87-84jw-cjhp","url":"https://osv.dev/vulnerability/GHSA-6q87-84jw-cjhp"}],"summary":"@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params"}