362 matches found
npm: Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
npm: Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering vulnerability discovered by ? in WordPress npm astro versions 7.3.2...
EUVD-2026-107411
Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering...
GHSA-98HJ-9722-W3J8 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Summary Astro's JSX and MDX rendering pipeline treated string children of and elements as trusted HTML. When a dynamic value was passed through a JSX expression, such as value, an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other J...
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Summary Astro's JSX and MDX rendering pipeline treated string children of and elements as trusted HTML. When a dynamic value was passed through a JSX expression, such as value, an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other J...
CVE-2026-114128
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128
The Astro web framework is vulnerable to Reflected/Stored Cross-Site Scripting (XSS) in versions prior to 7.3.2 . The JSX and MDX rendering pipeline (specifically the astro:jsx renderer ) fails to distinguish between compiler-generated literal content and dynamic expression values within script a...
CVE-2026-114128
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
PT-2026-120731
Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.3.2 Description The JSX and MDX rendering pipeline in the astro:jsx renderer treats string children of script and style elements as trusted HTML. It fails to distinguish between compiler-generated literal content and...
Astro cross-site scripting vulnerability
Versions prior to Astro 7.3.2 contain a cross-site scripting vulnerability. This vulnerability arises because the JSX and MDX rendering pipelines treat string sub-elements within script and style elements as trusted HTML, failing to distinguish between text content generated by the compiler and...
CLSA-2026-1792537744 TuxCare security update for @babel/plugin-syntax-jsx (1 CVE)
TuxCare rebuilt @babel/plugin-syntax-jsx to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
CLSA-2026-1792537743 TuxCare security update for @babel/plugin-syntax-jsx (1 CVE)
TuxCare rebuilt @babel/plugin-syntax-jsx to address 1 CVE. Fixed in 7.18.9-tuxcare.3...
CLSA-2026-1792537742 TuxCare security update for @babel/plugin-syntax-jsx (2 CVEs)
TuxCare rebuilt @babel/plugin-syntax-jsx to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...
CLSA-2026-1792537741 TuxCare security update for @babel/plugin-syntax-jsx (1 CVE)
TuxCare rebuilt @babel/plugin-syntax-jsx to address 1 CVE. Fixed in 7.21.5-tuxcare.1...
CLSA-2026-1792537740 TuxCare security update for @babel/plugin-syntax-jsx (1 CVE)
TuxCare rebuilt @babel/plugin-syntax-jsx to address 1 CVE. Fixed in 7.25.7-tuxcare.4...
CLSA-2026-1792537737 TuxCare security update for @babel/plugin-syntax-jsx (2 CVEs)
TuxCare rebuilt @babel/plugin-syntax-jsx to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...