PT-2025-7633 · Unknown · Dom-Expressions

Nsysean

·

Published

2025-02-21

·

Updated

2025-02-25

·

CVE-2025-27108

CVSS v3.1

7.3

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions dom-expressions versions prior to 0.39.5
Description The issue arises from the use of JavaScript's .replace() function, which opens up to potential Cross-site Scripting (XSS) vulnerabilities with special replacement patterns beginning with $. Specifically, when the attributes of the Meta tag from solid-meta are user-defined, attackers can utilize the special replacement patterns, either $' or `$`` to achieve XSS. This vulnerability can be exploited if the attributes of an asset tag contain user-controlled data, allowing attackers to execute arbitrary JavaScript in the victim's web browser.
Recommendations For versions prior to 0.39.5, upgrade to version 0.39.5 or later to address the issue. As a temporary workaround, consider restricting the use of user-controlled data in the attributes of the Meta tag to minimize the risk of exploitation. Additionally, avoid using the .replace() function with special replacement patterns beginning with $ until the issue is resolved.

Exploit

Fix

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79CWE-116

Related Identifiers

CVE-2025-27108
GHSA-HW62-58PR-7WC5

Affected Products

Dom-Expressions