{"id":"CVE-2025-27109","summary":"Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js","details":"solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has been addressed in version 1.9.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","aliases":["GHSA-3qxh-p7jc-5xh6"],"modified":"2026-07-15T01:48:50.673407983Z","published":"2025-02-21T21:12:58.218Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-116","CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27109.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27109.json"},{"type":"ADVISORY","url":"https://github.com/solidjs/solid/security/advisories/GHSA-3qxh-p7jc-5xh6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27109"},{"type":"FIX","url":"https://github.com/solidjs/solid/commit/b93956f28ed75469af6976a98728e313d0edd236"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/solidjs/solid","events":[{"introduced":"0"},{"fixed":"b93956f28ed75469af6976a98728e313d0edd236"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.9.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.9.3","v1.9.2","v1.9.0","v1.8.23","v1.8.22","v1.8.21","v1.8.20","v1.8.19","v1.8.18","v1.8.17","v1.8.16","v1.8.15","v1.8.14","v1.8.13","v1.8.12","v1.8.11","v1.8.10","v1.8.9","v1.8.8","v1.8.7","v1.8.6","v1.8.5","v1.8.4","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.12","v1.7.11","v1.7.10","v1.7.9","v1.7.8","v1.7.7","v1.7.6","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.6.16","v1.6.15","v1.6.14","v1.6.13","v1.6.12","v1.6.11","v1.6.10","v1.6.9","v1.6.8","v1.6.7","v1.6.6","v1.6.5","v1.6.4","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.6","v1.5.5","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.8","v1.4.7","v1.4.6","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.4.1","v1.4.0","v1.3.17","v1.3.16","v1.3.15","v1.3.14","v1.3.13","v1.3.12","v1.3.11","v1.3.10","v1.3.9","v1.3.8","v1.3.7","v1.3.6","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.3.0-rc.4","v1.3.0-rc.3","v1.3.0-rc.2","v1.3.0-rc.1","v1.3.0-rc.0","v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.2.0-beta.0","v1.1.7","v1.1.6","v1.1.6-beta.1","v1.1.5","v1.1.4","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v1.0.0-rc.10","v1.0.0-rc.9","v1.0.0-rc.8","v1.0.0-rc.7","v1.0.0-rc.6","v1.0.0-rc.5","v1.0.0-rc.4","v1.0.0-rc.3","v1.0.0-rc.2","v0.26.5","v0.26.5-beta.0","v0.26.4","v0.26.3","v0.26.2","v0.26.1","v0.26.0","v0.25.1","v0.25.0","v0.24.16","v0.24.15","v0.24.14","v0.24.13","v0.24.12","v0.24.11","v0.24.10","v0.24.9","v0.24.8","v0.24.7","v0.24.6","v0.24.6-beta.0","v0.24.5","v0.24.4","v0.24.3","v0.24.2","v0.24.1","v0.24.0","v0.23.11","v0.23.10","v0.23.9","v0.23.8","v0.23.7","v0.23.6","v0.23.5","v0.23.4","v0.23.3","v0.23.2","v0.23.1","v0.23.0","v0.22.10","v0.22.9","v0.22.8","v0.22.7","v0.22.6","v0.22.5","v0.22.4","v0.22.3","v0.22.2","v0.22.1","v0.22.0","v0.21.6","v0.21.5","v0.21.4","v0.21.3","v0.21.2","v0.21.1","v0.21.0","v0.20.3","v0.20.2","v0.20.1","v0.20.0","v0.20.0-beta.10","v0.20.0-beta.9","v0.20.0-beta.8","v0.20.0-beta.7","v0.20.0-beta.6","v0.20.0-beta.5","v0.20.0-beta.4","v0.20.0-beta.3","v0.20.0-beta.2","v0.20.0-beta.1","v0.20.0-beta.0","v0.19.2","v0.19.1","v0.19.0","v0.19.0-beta.5","v0.19.0-beta.4","v0.19.0-beta.3","v0.19.0-beta.2","v0.19.0-beta.1","v0.19.0-beta.0","v0.18.12","v0.18.11","v0.18.10","v0.18.9","v0.18.8","v0.18.7","v0.18.6","v0.18.5","v0.18.4","v0.18.3","v0.18.2","v0.18.1","v0.18.0","v0.17.7","v0.17.6","v0.17.5","v0.17.4","v0.17.3","v0.17.2","v0.17.1","v0.17.0","v0.16.14","v0.16.13","v0.16.12","v0.16.11","v0.16.10","v0.16.9","v0.16.8","v0.16.7","v0.16.6","v0.16.5","v0.16.4","v0.16.3","v0.16.2","v0.16.2-beta.4","v0.16.2-beta.3","v0.16.2-beta.2","v0.16.2-beta.1","v0.16.2-beta.0","v0.16.1","v0.16.0","v0.15.5","v0.15.4","v0.15.3","v0.15.2","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.2","v0.7.0","v0.6.0","v0.5.1","v0.5.0","v0.4.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27109.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}