High, CVSS 7.3npmAmendedPublished
DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace
CVE-2025-27108 · GHSA-hw62-58pr-7wc5
- Affected
- npm dom-expressions < 0.39.5
- Fixed in
- 0.39.5· Vendor fix available
- Issue
- [!NOTE] This advisory was originally emailed to community@solidjs.com by @nsysean. To sum it up, the use of javascript's .replace() opens up to potential XSS vulnerabilities with the special replacement patterns beginning with $. Particularly, when the attributes of Meta tag from solid-meta are user-defined, attackers can utilise the special replacement patterns, either $' or $\ to achieve XSS. The solid-meta package has this issue since it uses useAffect and context providers, which injects the used assets in the html header. "dom-expressions" uses .replace() to insert the assets, which is vulnerable to the special replacement patterns listed above. This effectively means that if the attributes of an asset tag contained user-controlled data, it would be vulnerable to XSS. For instance, there might be meta tags for the open graph protocol in a user profile page, but if attackers set the user query to some payload abusing .replace(), then they could execute arbitrary javascript in the…
Recommended action: Upgrade to 0.39.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.