CVE-2026-126361

The web framework Astro is vulnerable to Cross-Site Scripting (XSS) via attribute injection in dynamic tag names prior to version 7.4.5 . The vulnerability exists because the .astro , JSX , and MDX renderers processed dynamic element names as raw HTML using an incomplete character filter. An atta...