Executive brief
SolidJS, a popular JavaScript library for building user interfaces, contains a security flaw where it fails to properly clean user-provided data when used inside certain code structures called JSX fragments. This could allow an attacker to inject malicious scripts into a website, potentially leading to the theft of user session data or unauthorized actions on behalf of visitors. Organizations using SolidJS should update to the latest version to ensure user data remains protected.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in SolidJS due to improper encoding/escaping (CWE-116) within JSX fragments. Specifically, JSX expressions placed inside inlined fragments are not correctly sanitized, allowing raw HTML and script tags to be rendered in the browser. An attacker can exploit this by providing malicious input (e.g., via URL parameters) that is subsequently rendered within a fragment. This is a network-reachable vulnerability requiring no special privileges or user interaction beyond visiting a compromised link. The issue is fixed in version 1.9.4.
Affected products
- SolidJS solid-js < 1.9.4
Timeline
- 2025-02-21: advisory: NVD and GitHub advisory published
- 2025-02-21: patched: Fix committed in version 1.9.4
- 2025-02-25: disclosed