CVE-2025-27108: Ryansolid Dom Expressions XSS Vulnerability

CVE-2025-27108 Overview

CVE-2025-27108 is a Cross-Site Scripting (XSS) vulnerability in dom-expressions, a fine-grained runtime for performant DOM rendering used by the SolidJS ecosystem. The flaw stems from the use of JavaScript's String.prototype.replace() when injecting assets into the HTML header. Attackers can abuse special replacement patterns beginning with $, specifically $' and $`, to inject arbitrary markup. When Meta tag attributes from solid-meta contain user-controlled data, this behavior enables execution of attacker-supplied JavaScript in the victim's browser. The issue is fixed in version 0.39.5.

Critical Impact
User-controlled data reaching Meta tag attributes can result in stored or reflected XSS, allowing attackers to execute arbitrary JavaScript in victim browsers.

Affected Products

ryansolid dom-expressions versions prior to 0.39.5
solid-meta package consumers relying on the vulnerable runtime
SolidJS server-side rendered applications injecting user data into asset tags

Discovery Timeline

2025-02-21 - CVE-2025-27108 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27108

Vulnerability Analysis

The vulnerability is a Cross-Site Scripting flaw [CWE-79] in the server-side rendering path of dom-expressions. The library uses String.prototype.replace() to insert resolved SSR payloads into HTML output. JavaScript's replace() method interprets specific sequences in the replacement string as pattern references. The sequence $' inserts the substring following the match, $` inserts the substring preceding the match, and $& inserts the matched substring itself.

When solid-meta renders Meta tags with user-controlled attribute values, those values become part of the replacement string. An attacker can craft an attribute payload containing $' to duplicate portions of the surrounding HTML into the injection point. This effectively bypasses standard attribute escaping and permits injection of new tags or event handlers.

Because Meta tags are often populated from user profile fields, Open Graph metadata, or query parameters, exploitation can be both reflected and stored. Successful exploitation leads to arbitrary JavaScript execution in the victim's browser context.

Root Cause

The root cause is the unsafe use of html.replace(match, resolveSSRNode(payloadFn())) in packages/dom-expressions/src/server.js. The second argument to replace() is treated as a pattern-aware replacement string, not a literal, and the payload was not passed through an escape function before insertion.

Attack Vector

An attacker submits data containing $' or $` sequences into any field that ultimately populates a Meta tag attribute rendered via SSR. When another user requests the affected page, the server concatenates the malicious payload into the HTML, and replace() expands the pattern references into attacker-controlled markup, resulting in XSS.

javascript

// Security patch in packages/dom-expressions/src/server.js
const first = html.indexOf(placeholder);
if (first === -1) return;
const last = html.indexOf(`<!--!$/${id}-->`, first + placeholder.length);
-      html = html.replace(
-        html.slice(first, last + placeholder.length + 1),
-        resolveSSRNode(payloadFn())
-      );
+      html = html.slice(0, first) + resolveSSRNode(escape(payloadFn())) + html.slice(last + placeholder.length + 1);
// Source: https://github.com/ryansolid/dom-expressions/commit/521f75dfa89ed24161646e7007d9d7d21da07767

The fix replaces String.replace() with explicit slice-and-concat and wraps the payload in escape(), preventing both pattern expansion and unescaped HTML injection.

Detection Methods for CVE-2025-27108

Indicators of Compromise

HTTP request parameters containing the literal sequences $', $`, or $& targeting fields that flow into Meta tags
Rendered HTML pages containing unexpected <script> tags or event handler attributes inside <head> metadata
Anomalous outbound requests from user browsers to attacker-controlled domains after loading pages with user-generated Open Graph data

Detection Strategies

Perform a dependency inventory to identify projects using dom-expressions at versions below 0.39.5, including transitive dependencies via solid-meta and solid-start.
Run static analysis on server-rendered templates to locate Meta tags whose attributes are populated from request parameters, database records, or profile data.
Add web application firewall (WAF) rules to flag request bodies containing $' or $` sequences in fields that map to metadata attributes.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture attempts to execute inline scripts injected via metadata.
Log and review server-side rendering output for unexpected characters in Meta tag attribute values.
Correlate authentication events with subsequent DOM script execution reports to identify session hijack attempts.

How to Mitigate CVE-2025-27108

Immediate Actions Required

Upgrade dom-expressions to version 0.39.5 or later across all application and library dependencies.
Rebuild and redeploy any SolidJS applications that consume solid-meta or perform SSR through dom-expressions.
Audit user profile pages, Open Graph metadata endpoints, and any route rendering Meta tags from user input for injected payloads.

Patch Information

The issue is resolved in dom-expressions0.39.5. The fix is available in the upstream commit that replaces the vulnerable String.replace() call with a slice-based concatenation and applies escape() to the payload. See the GitHub Security Advisory GHSA-hw62-58pr-7wc5 and the upstream patch commit for details.

Workarounds

No official workarounds exist for this vulnerability. Upgrading to 0.39.5 is required.
As a defense-in-depth measure, enforce a strict Content Security Policy that disallows inline scripts and unsafe event handlers.
Sanitize or reject user-supplied metadata values containing $ sequences until the patched version is deployed.

bash

# Upgrade dom-expressions and rebuild the application
npm install dom-expressions@^0.39.5
npm ls dom-expressions
npm run build