@ASTROJS/SOLID-JS · GHSA-jmv2-qgxf-f995 · Package
FIX → 7.1.2
The @astrojs/solid-js renderer writes slot names into an HTML attribute without escaping, so a crafted slot name can break out and inject HTML. An attacker who gets a user to open a crafted link can run JavaScript on the site's origin, but only where the page passes request input as a slot name and the Solid component renders that slot by name.
first public Oct 28, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites built with Astro that use the @astrojs/solid-js integration and hydrate Solid components with a client directive. The exposure needs a page that takes a slot name from request input and a component that renders the slot by its dynamic name. Sites that do not use request data as slot names, or that map it to a fixed set of known names, are not exposed.
Not affected if no-client-directive, no-dynamic-slot-names, static-content-only, version-7.1.2-or-later
Who cares astro, npm, solid-js
npm ls @astrojs/solid-js; versions >= 0.2.0 and <= 7.1.1 are affected.client:* hydrated Solid component.Upgrade to 7.1.2
The @astrojs/solid-js renderer wraps named slot content passed to Solid components in an <astro-slot> element, and writes the slot name into its name attribute without HTML escaping. A slot name containing " could end the attribute and inject arbitrary HTML into the page.
For example, a page that takes a slot name from the request:
---
import Tabs from '../components/Tabs.jsx';
const tab = Astro.url.searchParams.get('tab');
---
<Tabs client:load active={tab}><div slot={tab}>…</div></Tabs>
rendered with a Solid component that renders a slot by name:
export default function Tabs(props) {
return <div>{props[props.active]}</div>;
}
would output a tab value such as as live HTML.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
@astrojs/solid-js upgrade to 7.1.2x"><img src=x onerror=alert(1)>Reflected cross-site scripting. An attacker who gets a user to open a crafted link can run JavaScript on the site's origin, but only in applications where all of the following are true:
client:* directive. For non-hydrated components the slot wrapper is removed from the output, together with its name attribute.This is the @astrojs/solid-js counterpart of GHSA-8hv8-536x-4wqp (CVE-2026-50146), which fixed the same issue in astro core.
@astrojs/solid-js >= 0.2.0, <= 7.1.1.
Fixed in @astrojs/solid-js 7.1.2. Slot names are now HTML-escaped in the server renderer.
Upgrade to @astrojs/solid-js 7.1.2 or later. Before upgrading, do not use request-controlled input as a slot name, or map it to a fixed set of known slot names before passing it to a component.
Reported by @manus-pi.