CVE-2025-27109

High

Published: 21 February 2025

Published

21 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0010 26.3th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27109 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the vulnerability by requiring timely installation of the solid-js 1.9.4 patch that fixes the lacking escaping in JSX fragments.

SI-15 Information Output Filtering good match

prevent

Prevents XSS exploitation by filtering and encoding user input prior to rendering as HTML in web outputs, addressing CWE-79 and CWE-116.

SI-10 Information Input Validation partial match

prevent

Mitigates by validating and sanitizing user inputs to block malicious payloads before they reach the vulnerable JSX rendering.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

This XSS vulnerability in a JavaScript UI library allows remote unauthenticated attackers to inject and execute arbitrary HTML/JS in the victim's browser without user interaction, directly enabling exploitation of public-facing applications (T1190) and JavaScript command/script execution (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This…

issue has been addressed in version 1.9.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Deeper analysisAI

CVE-2025-27109 affects solid-js, a declarative JavaScript library for building user interfaces, in versions prior to 1.9.4. The vulnerability arises when inserts/JSX expressions inside illegal inlined JSX fragments lack proper escaping, allowing user input placed directly inside those fragments to be rendered as HTML. This flaw is classified under CWE-79 (cross-site scripting) and CWE-116 (improper encoding or escaping of output).

The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating it is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Attackers can achieve limited impacts on confidentiality, integrity, and availability by injecting user-controlled data into affected JSX fragments, resulting in the execution of arbitrary HTML in the victim's browser context.

The SolidJS security advisory (GHSA-3qxh-p7jc-5xh6) and fixing commit (b93956f28ed75469af6976a98728e313d0edd236) confirm the issue was addressed in version 1.9.4, urging all users to upgrade immediately. No workarounds are known.