CVE-2026-114127

The Astro web framework (versions 7.1.0 to 7.3.3 ) is vulnerable to arbitrary CSS injection within its server-side View Transition CSS generator. The root cause is the failure to keep string animation properties (such as duration , delay , easing , direction , fillMode , or animation names ) with...