{"action":"Upgrade dom-expressions to 0.39.5 or later.","affected":[{"fixed":"0.39.5","introduced":"0"}],"component":"dom-expressions","cve_ids":["CVE-2025-27108"],"ecosystem":"npm","epss":0.00277,"exploited":false,"fixed_versions":["0.39.5"],"ghsa_id":"GHSA-hw62-58pr-7wc5","id":"tcs_01M5KFW78HATK8SHNPCFWKRARG","modified_at":"2025-02-25T17:49:58Z","published_at":"2025-02-25T17:49:57Z","references":["https://osv.dev/vulnerability/GHSA-hw62-58pr-7wc5","https://github.com/ryansolid/dom-expressions/security/advisories/GHSA-hw62-58pr-7wc5","https://nvd.nist.gov/vuln/detail/CVE-2025-27108","https://github.com/ryansolid/dom-expressions/commit/521f75dfa89ed24161646e7007d9d7d21da07767","https://github.com/ryansolid/dom-expressions"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-hw62-58pr-7wc5","url":"https://osv.dev/vulnerability/GHSA-hw62-58pr-7wc5"}],"summary":"DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace"}