Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)
Date: 2025-02
Affected: npm/solid-js
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-27109
CWE: CWE-116
CWE-79
CVSS: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. For instance, `?text=<svg/onload=alert(1)>` would trigger XSS here. ```js const [text] = createResource(() => { return new URL(getRequestEvent().request.url).searchParams.get("text"); }); return ( <> Text: {text()} </> ); ```


Mitigations:

Architectural layers (MAESTRO):