486 matches found
Astro: Reflected/Stored XSS Via Unescaped <script>/<style> Tag Content In JSX/MDX Rendering
Summary Astro's JSX and MDX rendering pipeline treated string children of "", an attacker-controlled value containing "...
Cross-site Scripting (XSS)
Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the prerenderElementChildren function in jsx.ts and the streaming renderer in streaming.ts, where dynami...
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Summary Astro's JSX and MDX rendering pipeline treated string children of and elements as trusted HTML. When a dynamic value was passed through a JSX expression, such as value, an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other J...
EUVD-2026-107411
Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering...
npm: Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
npm: Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering vulnerability discovered by ? in WordPress npm astro versions 7.3.2...
GHSA-98HJ-9722-W3J8 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Summary Astro's JSX and MDX rendering pipeline treated string children of and elements as trusted HTML. When a dynamic value was passed through a JSX expression, such as value, an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other J...
CVE-2026-114128
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128
The Astro web framework is vulnerable to Reflected/Stored Cross-Site Scripting (XSS) in versions prior to 7.3.2 . The JSX and MDX rendering pipeline (specifically the astro:jsx renderer ) fails to distinguish between compiler-generated literal content and dynamic expression values within script a...
PT-2026-120731
Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.3.2 Description The JSX and MDX rendering pipeline in the astro:jsx renderer treats string children of script and style elements as trusted HTML. It fails to distinguish between compiler-generated literal content and...
Astro cross-site scripting vulnerability
Versions prior to Astro 7.3.2 contain a cross-site scripting vulnerability. This vulnerability arises because the JSX and MDX rendering pipelines treat string sub-elements within script and style elements as trusted HTML, failing to distinguish between text content generated by the compiler and...
CLSA-2026-1792364014 TuxCare security update for @next/mdx (1 CVE)
TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 16.0.6-tuxcare.10...
CLSA-2026-1792364012 TuxCare security update for @next/mdx (1 CVE)
TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 12.3.7-tuxcare.10...
CLSA-2026-1792364013 TuxCare security update for @next/mdx (2 CVEs)
TuxCare rebuilt @next/mdx to address 2 CVEs. Fixed in 13.5.11-tuxcare.18...
CLSA-2026-1792364011 TuxCare security update for @next/mdx (1 CVE)
TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 14.2.35-tuxcare.8...