EUVD-2026-124745

Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and...

CVE-2026-126363

The @astrojs/solid-js renderer (versions 0.2.0 to 7.1.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) because it inserts named slots into the name attribute of an element without proper HTML escaping . An attacker can provide a request-controlled slot name containing a quote (e.g., via...