GHSA-3QXH-P7JC-5XH6 Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)

Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. For instance, ?text= would trigger XSS here. js const text = createResource = return new...

CVE-2025-27109

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

CVE-2025-27109

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

CVE-2025-27109 Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

CVE-2025-27109

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

CVE-2025-27109: Improper Encoding or Escaping of Output

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

PT-2025-7634 · Solid-Js · Solid-Js

Name of the Vulnerable Software and Affected Versions: solid-js versions prior to 1.9.4 Description: The issue concerns a lack of escaping in Inserts/JSX expressions inside illegal inlined JSX fragments, allowing user input to be rendered as HTML when put directly inside JSX fragments. This can...

Malicious code in babel-plugin-remove-jsx-empty-expression (npm)

The package communicates with a domain associated with malicious activity...

CVE-2024-56082

The Lumos web browsing tool, developed by Andrew Nguonly, is vulnerable in versions prior to 1.0.17 due to an improper neutralization of input during web page generation (CWE-79 ). The ChatBar.tsx component parses raw HTML from Markdown because the markdown-to-jsx package is utilized without sett...

CVE-2024-56082: Improper Neutralization of Input During Web Page Generation

ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true...

CVE-2024-56082

ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true...

PT-2024-36709 · Unknown +1 · Markdown-To-Jsx +1

Name of the Vulnerable Software and Affected Versions: Lumos versions prior to 1.0.17 Description: The issue arises from the ChatBar.tsx component in Lumos, which parses raw HTML in Markdown. This occurs because the markdown-to-jsx package is used without setting disableParsingRawHTML to true...

Lumos security vulnerabilities

Lumos is a tool by Andrew Nguonly personal developer. It is used for browsing web pages. A security vulnerability exists in Lumos versions prior to 1.0.17, which stems from the use of the markdown-to-jsx package without disableParsingRawHTML set to true, where ChatBar.tsx parses raw HTML from...

CVE-2024-56082

ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true...

Cross-site Scripting (XSS)

markdown-to-jsx is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization, where an attacker can execute arbitrary code by injecting a malicious iframe element via the src property in the markdown...

SUSE CVE-2024-21535

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown...

MAL-2024-9772 Malicious code in plugin-vue-jsx (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in plugin-vue-jsx (npm)

--- -= Per source details. Do not edit below this line.=-...

GHSA-4WX3-54GH-9FR9 Cross site scripting in markdown-to-jsx

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown...

@apolitical/component-library (>=1.7.0-beta.1, <=10.6.0), @apolitical/styleguide2 (>=3.17.0-rc.1, <=7.8.1) +60 more potentially affected by CVE-2024-21535 via markdown-to-jsx (>=7.0.0, <=7.3.2)

markdown-to-jsx NPM version =7.0.0, =1.7.0-beta.1, =3.17.0-rc.1, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =6.1.1, =7.3.2, =0.1.0, =0.9.1, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =0.1.0-alpha.39, =1.1.1-beta.3, =1.2.2 and more Source cves: CVE-2024-21535 Source advisory:...