Junglewise Threat Intelligence

CVE-2025-27108: DOM Expressions cross-site scripting in string.replace

CVE-2025-27108 · Severity: low · CVSS 3.1 · Published 2025-02-25

Vendors: npm.

Executive brief

DOM Expressions is a JavaScript library used to build dynamic web interfaces in Solid.js applications. The library improperly sanitizes user-controlled data when inserting meta tag attributes, allowing attackers to inject arbitrary JavaScript code through special replacement patterns. An attacker can craft a malicious payload (for example, in a user profile's meta tag) to execute code in victims' browsers or perform account takeover and data theft.

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in dom-expressions caused by improper use of JavaScript's string.replace() method. The library uses .replace() to insert assets into HTML headers without properly escaping special replacement patterns ($ and Junglewise ) that have special meaning in replace operations. When user-controlled data is passed as meta tag attributes (e.g., Open Graph protocol tags on user profile pages), an attacker can include these special patterns to break out of the intended string context and execute arbitrary JavaScript. The vulnerability affects all versions prior to 0.39.5, is network-exploitable with no authentication required, and can result in stored XSS if the malicious payload is persisted. The fix is available in version 0.39.5.

Affected products

  • Solid.js DOM Expressions < 0.39.5

Timeline

  • 2025-02-21: disclosed: Advisory published on GitHub and NVD
  • 2025-02-25: patched: Fix available in version 0.39.5

References