Detections
Analytics

SCA: security update for dom-expressions (GHSA-hw62-58pr-7wc5)

medium Tenable Cloud Security Plugin ID 420996

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of
 javascript's `.replace()` opens up to potential Cross-site Scripting (XSS) vulnerabilities with the
 special replacement patterns beginning with `$`. Particularly, when the attributes of `Meta` tag from
 solid-meta are user-defined, attackers can utilise the special replacement patterns, either `$'` or `$\``
 to achieve XSS. The solid-meta package has this issue since it uses `useAffect` and context providers,
 which injects the used assets in the html header. "dom-expressions" uses `.replace()` to insert the
 assets, which is vulnerable to the special replacement patterns listed above. This effectively means that
 if the attributes of an asset tag contained user-controlled data, it would be vulnerable to XSS. For
 instance, there might be meta tags for the open graph protocol in a user profile page, but if attackers
 set the user query to some payload abusing `.replace()`, then they could execute arbitrary javascript in
 the victim's web browser. Moreover, it could be stored and cause more problems. This issue has been
 addressed in version 0.39.5 and all users are advised to upgrade. There are no known workarounds for this
 vulnerability. (CVE-2025-27108)

See Also

https://github.com/advisories/GHSA-hw62-58pr-7wc5

Plugin Details

Severity: Medium

ID: 420996

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 2/25/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2025-27108

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/25/2025

Vulnerability Publication Date: 2/21/2025

Reference Information

CVE: CVE-2025-27108