Nsysean

**Name of the Vulnerable Software and Affected Versions** HtmlSanitizer versions prior to 9.0.892 HtmlSanitizer versions prior to 9.1.893-beta **Description** HtmlSanitizer is a .NET library designed to prevent cross-site scripting (XSS) attacks by cleaning HTML fragments and documents. Before versions 9.0.892 and 9.1.893-beta, the library did not sanitize the contents of the template tag when it was permitted. The template tag typically does not render its contents unless the `shadowrootmode` attribute is set to 'open' or 'closed'. **Recommendations** Update to HtmlSanitizer version 9.0.892 or later. Update to HtmlSanitizer version 9.1.893-beta or later.

**Name of the Vulnerable Software and Affected Versions** dom-expressions versions prior to 0.39.5 **Description** The issue arises from the use of JavaScript's `.replace()` function, which opens up to potential Cross-site Scripting (XSS) vulnerabilities with special replacement patterns beginning with `$`. Specifically, when the attributes of the `Meta` tag from solid-meta are user-defined, attackers can utilize the special replacement patterns, either `$'` or `$`` to achieve XSS. This vulnerability can be exploited if the attributes of an asset tag contain user-controlled data, allowing attackers to execute arbitrary JavaScript in the victim's web browser. **Recommendations** For versions prior to 0.39.5, upgrade to version 0.39.5 or later to address the issue. As a temporary workaround, consider restricting the use of user-controlled data in the attributes of the `Meta` tag to minimize the risk of exploitation. Additionally, avoid using the `.replace()` function with special replacement patterns beginning with `$` until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** solid-js versions prior to 1.9.4 **Description** The issue concerns a lack of escaping in Inserts/JSX expressions inside illegal inlined JSX fragments, allowing user input to be rendered as HTML when put directly inside JSX fragments. This can lead to XSS attacks. For example, a URL parameter like `?text=<svg/onload=alert(1)>` could trigger an XSS attack. The issue has been addressed in version 1.9.4. **Recommendations** To resolve the issue, upgrade to version 1.9.4 or later. As a temporary workaround, consider validating and sanitizing user input to prevent XSS attacks. Restrict access to vulnerable components until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: DOMPurify versions prior to 3.2.4 Description: The issue is related to an incorrect template literal regular expression in DOMPurify, which can lead to mutation cross-site scripting (mXSS). Recommendations: For versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** KaTeX versions prior to 0.16.21 **Description** The issue is related to the `renderToString` function in the KaTeX JavaScript library, which is used for rendering mathematical expressions. It is caused by incorrect encoding or escaping of output when handling the `htmlData` parameter. This could allow a remote attacker to execute arbitrary code. Users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `htmlData` that runs arbitrary JavaScript or generates invalid HTML. **Recommendations** For versions prior to 0.16.21, upgrade to KaTeX v0.16.21 to remove this vulnerability. As a temporary workaround, consider turning off the `trust` option or setting it to forbid `htmlData` commands. Forbid inputs containing the substring `"htmlData"`. Sanitize HTML output from KaTeX to minimize the risk of exploitation.