CVE-2025-27109
Last modified
CVE-2025-27109 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has been addressed in version 1.9.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-27109?
How severe is CVE-2025-27109?
How do I fix CVE-2025-27109?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-27103DataEase is an open source business intelligence and data vi…6.5
- CVE-2025-27104vyper is a Pythonic Smart Contract Language for the EVM. Mul…7.5
- CVE-2025-27105vyper is a Pythonic Smart Contract Language for the EVM. Vyp…9.1
- CVE-2025-27106binance-trading-bot is an automated Binance trading bot with…8.8
- CVE-2025-27107Integrated Scripting is a tool for creating scripts for hand…8.6
- CVE-2025-27108dom-expressions is a Fine-Grained Runtime for Performant DOM…6.1
- CVE-2025-2711A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has…6.1
- CVE-2025-27110Libmodsecurity is one component of the ModSecurity v3 projec…7.5
- CVE-2025-27111Rack is a modular Ruby web server interface. The Rack::Sendf…7.5
- CVE-2025-27112Navidrome is an open source web-based music collection serve…6.5
- CVE-2025-27113libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL p…7.5
- CVE-2025-2712A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has…6.1
Are you affected by CVE-2025-27109?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST