astro-simpleanalytics-plugin (0.4.0), lanza-site (>=0.1.0, <=0.1.10) potentially affected by CVE-2026-59729 via astro (>=7.0.2, <=7.0.3)

🗓️ 20 Jul 2026 23:21:58Reported by Vulners OSVType

vulnersosv🔗 osv.dev👁 11 Views

astro versions 7.0.2-7.0.3 affected by CVE-2026-59729, impacting astro-simpleanalytics-plugin and lanza-site.

Reporter	Title	Published	Views	Family All 16
CVE	CVE-2026-59729	27 Jul 202619:38	–	cve
Cvelist	CVE-2026-59729 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)	27 Jul 202619:38	–	cvelist
EUVD	EUVD-2026-49580	27 Jul 202619:38	–	euvd
Github Security Blog	Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)	20 Jul 202623:21	–	github
NVD	CVE-2026-59729	27 Jul 202620:16	–	nvd
OSV	CLSA-2026-1784596296 TuxCare security update for 9 packages (2 CVEs)	4 Aug 202614:52	–	osv
OSV	CLSA-2026-1786365605 TuxCare security update for 10 packages (4 CVEs)	10 Aug 202612:40	–	osv
OSV	CLSA-2026-1788970606 TuxCare security update for 8 packages (1 CVE)	9 Sep 202616:16	–	osv
OSV	GHSA-F48W-9M4C-M7F5 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)	20 Jul 202623:21	–	osv
Patchstack	NPM: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)	20 Jul 202623:21	–	patchstack

12 Aug 2026 20:45Current

5.3Medium risk

Vulners AI Score5.3

CVSS 45.1

EPSS0.00323

SSVC

astro CVE-2026-59729 transitive dependency vulnerable versions npm package security advisory dependency chain