GHSA-3qxh-p7jc-5xh6

Source

https://github.com/advisories/GHSA-3qxh-p7jc-5xh6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-3qxh-p7jc-5xh6/GHSA-3qxh-p7jc-5xh6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-3qxh-p7jc-5xh6

Aliases

CVE-2025-27109

Published

2025-02-25T17:49:40Z

Modified

2026-08-24T00:34:41Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)

Details

Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments.

For instance, ?text=<svg/onload=alert(1)> would trigger XSS here.

  const [text] = createResource(() => {
    return new URL(getRequestEvent().request.url).searchParams.get("text");
  });

  return (
    <>
      Text: {text()}
    </>
  );

Database specific

{
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-25T17:49:40Z",
    "nvd_published_at": "2025-02-21T22:15:14Z",
    "severity": "HIGH"
}

References

Affected packages

npm / solid-js

Package

Name: solid-js; View open source insights on deps.dev
Purl: pkg:npm/solid-js

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.9.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-3qxh-p7jc-5xh6/GHSA-3qxh-p7jc-5xh6.json"