CVE-2026-59729

UNKNOWN 0.0

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.

CWE	CWE-79
Vendor	withastro
Product	astro
Published	Jul 27, 2026

Stay Ahead of the Next One

Get instant alerts for withastro astro

Be the first to know when new unknown vulnerabilities affecting withastro astro are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

withastro / astro

< 7.0.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5 github.com: https://github.com/withastro/astro/pull/17251 github.com: https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d github.com: https://github.com/withastro/astro/releases/tag/[email protected]