GitStock

solidjs/solid · Security

Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)

GHSA ID
GHSA-3qxh-p7jc-5xh6
CVE ID
CVE-2025-27109
Severity
high
Published
Updated
CVSS
7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v3
7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments.

For instance, ?text=<svg/onload=alert(1)> would trigger XSS here.

  const [text] = createResource(() => {
    return new URL(getRequestEvent().request.url).searchParams.get("text");
  });

  return (
    <>
      Text: {text()}
    </>
  );

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-116 · Improper Encoding or Escaping of Output

References

Open GitHub