@astrojs/solid-js security alerts · Patchwire

⌘K

@astrojs/solid-js has 1 advisory. Fixed in 7.1.2.

Versions

Red: affected by at least one advisory. White: safe.

7.x

safe 7.1.2

AffectedSafe

Details

Safe: 7.1.2
Advisories: 1 in 120 days

Used by

Stacks that pull this package.

Not part of a tracked stack.

Alerts⁽¹⁾

Reflected XSS via unescaped slot names in @astrojs/solid-js

@astrojs/solid-js · 28 Oct

Medium

Exploitable only if · read by Claude, the source remains the reference

Project uses @astrojs/solid-js version >= 0.2.0 and <= 7.1.1.
A page passes request-controlled input (such as a query parameter) as a slot name to a Solid component.
The Solid component is hydrated with a client: directive.
The Solid component renders the attacker-chosen slot, e.g. by accessing slot props by a dynamic name.

Affected: @astrojs/solid-js >=0.2.0 <=7.1.1
Fixed in: 7.1.2
ID: GHSA-jmv2-qgxf-f995