CVE-2026-126361
Astro: XSS via attribute injection in dynamic tag names
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5.
| CWE | CWE-79 CWE-184 |
| Vendor | withastro |
| Product | astro |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for withastro astro
Be the first to know when new unknown vulnerabilities affecting withastro astro are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
withastro / astro
< 7.4.5
References
github.com: https://github.com/withastro/astro/security/advisories/GHSA-mh32-jxcr-mh9f github.com: https://github.com/withastro/astro/pull/18520 github.com: https://github.com/withastro/astro/commit/e023abac912d7cb6af2b9fb5107ef5dabc667096 github.com: https://github.com/withastro/astro/releases/tag/[email protected]