A reflected cross-site scripting (XSS) vulnerability exists in the @astrojs/solid-js renderer where slot names are not HTML-escaped before being written into the name attribute of an <astro-slot> element. This allows injection of arbitrary HTML if the slot name is attacker-controlled and contains special characters like a double quote. The vulnerability affects versions from 0.2.0 up to 7.1.1 and is fixed in version 7.1.2.