PT-2025-7634 · Solid-Js · Solid-Js

Nsysean · Published 2025-02-21 · Updated 2025-02-25 · CVE-2025-27109

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions solid-js versions prior to 1.9.4

Description The issue concerns a lack of escaping in Inserts/JSX expressions inside illegal inlined JSX fragments, allowing user input to be rendered as HTML when put directly inside JSX fragments. This can lead to XSS attacks. For example, a URL parameter like ?text=<svg/onload=alert(1)> could trigger an XSS attack. The issue has been addressed in version 1.9.4.

Recommendations To resolve the issue, upgrade to version 1.9.4 or later. As a temporary workaround, consider validating and sanitizing user input to prevent XSS attacks. Restrict access to vulnerable components until the issue is resolved.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2025-27109

GHSA-3QXH-P7JC-5XH6

Affected Products

Solid-Js

References · 12

• 🔥 https://github.com/solidjs/solid/security/advisories/GHSA-3qxh-p7jc-5xh6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27109.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-27109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27109 · Security Note
• https://osv.dev/vulnerability/GHSA-3qxh-p7jc-5xh6 · Vendor Advisory
• https://github.com/solidjs/solid · Note
• https://github.com/solidjs/solid/commit/b93956f28ed75469af6976a98728e313d0edd236 · Note
• https://t.me/cvenotify/112313 · Telegram Post
• https://t.me/latest_high_impact_cve/1865 · Telegram Post
• https://t.me/cvedetector/18693 · Telegram Post
• https://twitter.com/CVEnew/status/1893049433085907324 · Twitter Post
• https://twitter.com/ensyzip/status/1893106127161925806 · Twitter Post