Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| withastro | astro | 3.10.0 to before 7.0.4 | 7.0.4 | Patch available | CNA |
| — | astro (npm) | 3.10.0 to before 7.0.4 | 7.0.4 | Patch available | GHSA-7pw4-f3q4-r2p2 |
- astro Vendorwithastro Affected 3.10.0 to before 7.0.4 Fixed in 7.0.4 Patch available CNA
- astro (npm) Vendor— Affected 3.10.0 to before 7.0.4 Fixed in 7.0.4 Patch available GHSA-7pw4-f3q4-r2p2
Remediation
- Fix · CNA astro (withastro) Fixed in 7.0.4
- Fix · GHSA-7pw4-f3q4-r2p2 astro (npm) Fixed in 7.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-59727
- 2026-10-03 Alias added: GHSA-7pw4-f3q4-r2p2
References
Other 5
- https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2
- https://github.com/withastro/astro/pull/17212
- https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294
- https://github.com/withastro/astro/releases/tag/[email protected]
- https://github.com/withastro/astro
More withastro vulnerabilities
- TI-2026-26147 Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` CVSS 3.1CRITICAL 9.1
- TI-2026-42600 Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch CVSS 3.1HIGH 8.2
- TI-2024-37142 Server source code is exposed to the public if sourcemaps are enabled CVSS 4.0HIGH 7.8
- TI-2025-35987 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint CVSS 3.1HIGH 7.2
- TI-2025-34958 Unauthorized third-party images in Astro’s _image endpoint CVSS 4.0MEDIUM 6.9
- TI-2026-51542 Astro: Unauthenticated path override in the @astrojs/vercel ISR function CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-59727 · CVE Program
- CVE-2026-59727 · NVD
- FIRST EPSS
- GHSA-7pw4-f3q4-r2p2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences