CVE-2026-126363
Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Solid component using a client:* directive and dynamic access to the attacker-chosen slot property; a component that did not render that slot emitted only escaped fallback content. This issue is fixed in version 7.1.2.
| CWE | CWE-79 |
| Vendor | withastro |
| Product | astro |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for withastro astro
Be the first to know when new unknown vulnerabilities affecting withastro astro are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
withastro / astro
>= 0.2.0, < 7.1.2