-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @sveltejs/kit | npm | >= 2.0.0, < 2.20.6 | 2.20.6 |
Miggo AIRoot Cause AnalysisThe vulnerability occurs because unsanitized search parameter names, when iterated over in a server load function, are tracked and then embedded into a script tag in the server-rendered HTML.
The core issue lies in the stringify_uses function (in packages/kit/src/runtime/server/utils.js), which was responsible for preparing these tracked parameters for embedding. It used JSON.stringify for the array of parameter names, but JSON.stringify does not escape the '/' character. Thus, a parameter name like </script><script>alert(1)</script> would remain largely intact within the generated string.
This unsafe string was then consumed by the get_data function (in packages/kit/src/runtime/server/page/render.js), which concatenated it into a larger data structure that was embedded directly into a <script> block in the HTML page. The HTML parser would then encounter the </script> sequence from the malicious parameter name and could terminate the script block prematurely, allowing the subsequent injected script to execute.
The patch addressed this by:
stringify_uses (renamed to serialize_uses) to return a raw JavaScript object instead of a pre-formatted string.get_data to take this object and use devalue.uneval to serialize the entire payload. devalue.uneval correctly escapes characters like < and /, making the output safe for embedding in HTML.
A similar change was made in get_data_json, which also consumed stringify_uses.
Therefore, stringify_uses is identified as vulnerable because it produced the unsafe string, and get_data is identified as vulnerable because it embedded this unsafe string into HTML leading to XSS.