Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js
Priority HIGH 65CWE-116Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has been addressed in version 1.9.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00328 26th percentileScored 2026-11-07
Fix Fixed solid (solidjs): 1.9.4solid-js (npm): 1.9.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| solidjs | solid | before 1.9.4 | 1.9.4 | Patch available | CNA |
| — | solid-js (npm) | before 1.9.4 | 1.9.4 | Patch available | GHSA-3qxh-p7jc-5xh6 |
- solid Vendorsolidjs Affected before 1.9.4 Fixed in 1.9.4 Patch available CNA
- solid-js (npm) Vendor— Affected before 1.9.4 Fixed in 1.9.4 Patch available GHSA-3qxh-p7jc-5xh6
Remediation
- Fix · CNA solid (solidjs) Fixed in 1.9.4
- Fix · GHSA-3qxh-p7jc-5xh6 solid-js (npm) Fixed in 1.9.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27109
- 2026-10-03 Alias added: GHSA-3qxh-p7jc-5xh6
References
Sources
- CVE-2025-27109 · CVE Program
- CVE-2025-27109 · NVD
- FIRST EPSS
- GHSA-3qxh-p7jc-5xh6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences