GitHub Advisoryadvisory · npm
GHSA-3qxh-p7jc-5xh6 Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)
HIGH
Official page ↗
- Aliases
- CVE-2025-27109
- Ecosystem
- npm
- Packages
- solid-js
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-116, CWE-79
- Reviewed
- 2025-02-25
Affected packages
• npm solid-js: < 1.9.4 → fixed in 1.9.4
Description
Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments.
For instance, `?text=` would trigger XSS here.
```js
const [text] = createResource(() => {
return new URL(getRequestEvent().request.url).searchParams.get("text");
});
return (
<>
Text: {text()}
);
```
Related
Alias · CVE (1)
- CVE-2025-27109 solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. vulnerability