CVE-2026-59729 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 GHSA-jrpj-wcv7-9fh9 added an INVALIDATTRNAMECHAR guard to addAttribute so that spread-prop attribute names...

NPM: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

NPM: Astro: XSS via unescaped spread attribute names in renderHTMLElement incomplete fix for CVE-2026-54298 vulnerability discovered by ? in WordPress Npm astro versions 7.0.6...

GHSA-F48W-9M4C-M7F5 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Summary The fix for CVE-2026-54298 GHSA-jrpj-wcv7-9fh9 added an INVALIDATTRNAMECHAR guard to addAttribute so that spread-prop attribute names containing "' /= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement in packages/astro/src/runtime/server/render/dom.ts, has it...