Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| withastro | astro | before 7.0.6 | 7.0.6 | Patch available | CNA |
| — | astro (npm) | before 7.0.6 | 7.0.6 | Patch available | GHSA-f48w-9m4c-m7f5 |
- astro Vendorwithastro Affected before 7.0.6 Fixed in 7.0.6 Patch available CNA
- astro (npm) Vendor— Affected before 7.0.6 Fixed in 7.0.6 Patch available GHSA-f48w-9m4c-m7f5
Remediation
- Fix · CNA astro (withastro) Fixed in 7.0.6
- Fix · GHSA-f48w-9m4c-m7f5 astro (npm) Fixed in 7.0.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-59729
- 2026-10-03 Alias added: GHSA-f48w-9m4c-m7f5
References
Other 5
- https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5
- https://github.com/withastro/astro/pull/17251
- https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d
- https://github.com/withastro/astro/releases/tag/[email protected]
- https://github.com/withastro/astro
More withastro vulnerabilities
- TI-2026-26147 Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` CVSS 3.1CRITICAL 9.1
- TI-2026-42600 Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch CVSS 3.1HIGH 8.2
- TI-2024-37142 Server source code is exposed to the public if sourcemaps are enabled CVSS 4.0HIGH 7.8
- TI-2025-35987 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint CVSS 3.1HIGH 7.2
- TI-2025-34958 Unauthorized third-party images in Astro’s _image endpoint CVSS 4.0MEDIUM 6.9
- TI-2026-51542 Astro: Unauthenticated path override in the @astrojs/vercel ISR function CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-59729 · CVE Program
- CVE-2026-59729 · NVD
- FIRST EPSS
- GHSA-f48w-9m4c-m7f5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences