Cross-site Scripting (XSS)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the renderHTMLElement function. An attacker can inject arbitrary event-handler attributes or sibling...

GHSA-F48W-9M4C-M7F5 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Summary The fix for CVE-2026-54298 GHSA-jrpj-wcv7-9fh9 added an INVALIDATTRNAMECHAR guard to addAttribute so that spread-prop attribute names containing "' /= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement in packages/astro/src/runtime/server/render/dom.ts, has it...

PT-2026-61809

Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.0.6 Description A cross-site scripting XSS issue exists when the software is used with an SSR runtime that exposes a global HTMLElement such as Deno, Bun with a DOM shim, or jsdom/happy-dom in Node and a class extendi...

NPM: Astro: XSS via Unescaped Attribute Names in Spread Props

NPM: Astro: XSS via Unescaped Attribute Names in Spread Props vulnerability discovered by ? in WordPress Npm astro versions 6.4.6...

Astro: XSS via Unescaped Attribute Names in Spread Props

Summary The spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax ...props on an HTML element and the object...