CVE-2025-27109

Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js

State: Published
Severity: 7.3 High
Published: Feb 21, 2025
Updated: Feb 24, 2025
Reserved: Feb 18, 2025

Description

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has been addressed in version 1.9.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-116 Improper Encoding or Escaping of Output
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
solidsolidjs	< 1.9.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.