1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low1 (100.0%)
astrojs-solid-js
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 1LowAffects 1 version
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 1
Vulnerabilities (1)
Known vulnerabilities affecting astrojs-solid-js, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-jmv2-qgxf-f995 | Low | Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js## Summary The `@astrojs/solid-js` renderer wraps named slot content passed to Solid components in an `<astro-slot>` element, and writes the slot name into its `name` attribute without HTML escaping. A slot name containing `"` could end the attribute and inject arbitrary HTML into the page. For example, a page that takes a slot name from the request: ```astro --- import Tabs from '../components/Tabs.jsx'; const tab = Astro.url.searchParams.get('tab'); --- <Tabs client:load active={tab}><div slot={tab}>…</div></Tabs> ``` rendered with a Solid component that renders a slot by name: ```jsx e |
| GitHub (opens in a new tab) |
- GHSA-jmv2-qgxf-f995LowAstro: Reflected XSS via unescaped slot names in @astrojs/solid-js
>= 0.2.0, < 7.1.2
## Summary The `@astrojs/solid-js` renderer wraps named slot content passed to Solid components in an `<astro-slot>` element, and writes the slot name into its `name` attribute without HTML escaping. A slot name containing `"` could end the attribute and inject arbitrary HTML into the page. For example, a page that takes a slot name from the request: ```astro --- import Tabs from '../components/Tabs.jsx'; const tab = Astro.url.searchParams.get('tab'); --- <Tabs client:load active={tab}><div slot={tab}>…</div></Tabs> ``` rendered with a Solid component that renders a slot by name: ```jsx e
CVE: CVE-2026-126363