CVE-2025-27109

High

Published: 21 February 2025

Published

21 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0010 26.6th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27109 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-27109 affects solid-js, a declarative JavaScript library for building user interfaces, in versions prior to 1.9.4. The vulnerability arises when inserts/JSX expressions inside illegal inlined JSX fragments lack proper escaping, allowing user input placed directly inside those fragments to be rendered as HTML. This flaw is classified under CWE-79 (cross-site scripting) and CWE-116 (improper encoding or escaping of output).

The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating it is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Attackers can achieve limited impacts on confidentiality, integrity, and availability by injecting user-controlled data into affected JSX fragments, resulting in the execution of arbitrary HTML in the victim's browser context.

The SolidJS security advisory (GHSA-3qxh-p7jc-5xh6) and fixing commit (b93956f28ed75469af6976a98728e313d0edd236) confirm the issue was addressed in version 1.9.4, urging all users to upgrade immediately. No workarounds are known.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-5079

Vulnerability details

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This…

issue has been addressed in version 1.9.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CWE(s): CWE-79 CWE-116

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

This XSS vulnerability in a JavaScript UI library allows remote unauthenticated attackers to inject and execute arbitrary HTML/JS in the victim's browser without user interaction, directly enabling exploitation of public-facing applications (T1190) and JavaScript command/script execution (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0