CVE-2026-126365: withastro, @astrojs: Astro is a web framework for content-driven websites

Astro is a web framework for content-driven websites. Prior to @astrojs/prism 4.1.2, and from @astrojs/markdoc 0.3.0 until 2.1.2, runHighlighterWithAstro returned code unchanged when Prism had no grammar for the requested language, and callers inserted that result as raw HTML. A code block labele...

CVE-2026-126365 Astro: XSS via unescaped code for unsupported languages in @astrojs/prism

Astro is a web framework for content-driven websites. Prior to @astrojs/prism 4.1.2, and from @astrojs/markdoc 0.3.0 until 2.1.2, runHighlighterWithAstro returned code unchanged when Prism had no grammar for the requested language, and callers inserted that result as raw HTML. A code block labele...

CVE-2026-126365

The Astro web framework is vulnerable to Cross-Site Scripting (XSS) due to a flaw in how it handles unsupported languages in the @astrojs/prism and @astrojs/markdoc components. Specifically, the runHighlighterWithAstro() function returned code unchanged when no grammar existed for the requested l...

PT-2026-146088

Astro is a web framework for content-driven websites. Prior to @astrojs/prism 4.1.2, and from @astrojs/markdoc 0.3.0 until 2.1.2, runHighlighterWithAstro returned code unchanged when Prism had no grammar for the requested language, and callers inserted that result as raw HTML. A code block labele...