GHSA-3qxh-p7jc-5xh6
Suggest an improvement- Source
- https://github.com/advisories/GHSA-3qxh-p7jc-5xh6
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-3qxh-p7jc-5xh6/GHSA-3qxh-p7jc-5xh6.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-3qxh-p7jc-5xh6
- Aliases
- Related
- Published
- 2025-02-25T17:49:40Z
- Modified
- 2025-02-25T18:42:11.008724Z
- Severity
-
- 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)
- Details
-
Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments.
For instance,
?text=<svg/onload=alert(1)>would trigger XSS here.const [text] = createResource(() => { return new URL(getRequestEvent().request.url).searchParams.get("text"); }); return ( <> Text: {text()} </> ); - Database specific
{ "nvd_published_at": "2025-02-21T22:15:14Z", "cwe_ids": [ "CWE-116", "CWE-79" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-02-25T17:49:40Z" }- References
Affected packages
npm / solid-js
Package
- Name
- solid-js
- View open source insights on deps.dev
- Purl
- pkg:npm/solid-js