CVE-2026-126362
Astro: Reflected XSS via unescaped slot names in @astrojs/svelte
Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2.
| CWE | CWE-79 |
| Vendor | withastro |
| Product | astro |
| Published | Nov 12, 2026 |
Get instant alerts for withastro astro
Be the first to know when new unknown vulnerabilities affecting withastro astro are published — delivered to Slack, Telegram or Discord.