EUVD-2026-124742

Astro: XSS via attribute injection in dynamic tag names...

GHSA-MH32-JXCR-MH9F Astro: XSS via attribute injection in dynamic tag names

Summary When a dynamic tag const Tag = ...; resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle /. Because HTML parsers treat / inside a tag as an attribute separator, a tag name...

Astro: XSS via attribute injection in dynamic tag names

Summary When a dynamic tag const Tag = ...; resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle /. Because HTML parsers treat / inside a tag as an attribute separator, a tag name...

CVE-2026-126361

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

CVE-2026-126361: withastro astro: Astro is a web framework for content-driven websites

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

CVE-2026-126361 Astro: XSS via attribute injection in dynamic tag names

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

CVE-2026-126361

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

CVE-2026-126361

The web framework Astro is vulnerable to Cross-Site Scripting (XSS) via attribute injection in dynamic tag names prior to version 7.4.5 . The vulnerability exists because the .astro , JSX , and MDX renderers processed dynamic element names as raw HTML using an incomplete character filter. An atta...

CVE-2026-126361 Astro: XSS via attribute injection in dynamic tag names

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

PT-2026-146084

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

CVE-2026-126774

@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx...

CVE-2026-126774 @tinacms/mdx before 2.4.2 Code Injection via MDX Serializer Rich-Text Values

@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx...

EUVD-2026-123768

@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx...

CVE-2026-126774

@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx...

CVE-2026-126774 @tinacms/mdx before 2.4.2 Code Injection via MDX Serializer Rich-Text Values

@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx...

CVE-2026-126774

The @tinacms/mdx package before version 2.4.2 is vulnerable to a code injection vulnerability within its MDX serializer . The root cause is the failure to escape rich-text values when they are written into MDX expressions. This allows authenticated content editors to save crafted values that can ...

PT-2026-145426

@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx...

CVE-2026-126774: tinacms @tinacms/mdx: @tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values…

@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx...

Astro: Reflected/Stored XSS Via Unescaped <script>/<style> Tag Content In JSX/MDX Rendering

Summary Astro's JSX and MDX rendering pipeline treated string children of "", an attacker-controlled value containing "...

Cross-site Scripting (XSS)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the prerenderElementChildren function in jsx.ts and the streaming renderer in streaming.ts, where dynami...