CVE-2025-27108
📋 TL;DR
This vulnerability allows attackers to execute arbitrary JavaScript in victims' browsers through Cross-site Scripting (XSS) in dom-expressions and solid-meta packages. It affects applications using user-controlled data in meta tag attributes that get processed by vulnerable .replace() patterns. All users of affected versions are at risk.
💻 Affected Systems
- dom-expressions
- solid-meta
📦 What is this software?
Dom Expressions by Ryansolid
⚠️ Risk & Real-World Impact
Worst Case
Attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, performing actions as the user, or delivering malware.
Likely Case
XSS attacks leading to session hijacking, credential theft, or defacement of user-accessible pages with meta tags.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, but the core vulnerability remains.
🎯 Exploit Status
Requires user-controlled input in meta tag attributes and knowledge of .replace() special patterns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.39.5
Vendor Advisory: https://github.com/ryansolid/dom-expressions/security/advisories/GHSA-hw62-58pr-7wc5
Restart Required: No
Instructions:
1. Update dom-expressions to version 0.39.5 or later. 2. Update solid-meta if used. 3. Verify no breaking changes in your application.
🔧 Temporary Workarounds
No workarounds available
allThe advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Implement strict input validation and output encoding for all user-controlled data used in meta tags.
- Use Content Security Policy (CSP) headers to restrict script execution and mitigate XSS impact.
🔍 How to Verify
Check if Vulnerable:
Check package.json for dom-expressions version <0.39.5 or solid-meta using vulnerable dom-expressions.Check Version:
npm list dom-expressionsVerify Fix Applied:
Confirm dom-expressions version is 0.39.5 or later in package.json and dependencies.📡 Detection & Monitoring
Log Indicators:
- Unusual meta tag attribute values containing JavaScript patterns or special characters like $' or $`
Network Indicators:
- Unexpected script execution from meta tag injections
SIEM Query:
Search for patterns like $' or $` in user input fields that populate meta tags.