Read the docs
TI-2026-51540 Aliases CVE-2026-73422GHSA-4g3v-8h47-v7g6

Astro: Reflected XSS via unescaped View Transition animation properties

Priority MEDIUM 57CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition and can execute arbitrary JavaScript in the affected application's origin, allowing access to sensitive page data and authenticated actions available to the victim. This issue is fixed in version 7.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00547 46th percentileScored 2026-11-07
Fix Fixed astro (withastro): 7.1.0astro (npm): 7.1.0Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
withastroastro2.9.0 to before 7.1.07.1.0Patch availableCNA
—astro (npm)2.9.0 to before 7.1.07.1.0Patch availableGHSA-4g3v-8h47-v7g6
  • astro Vendorwithastro Affected 2.9.0 to before 7.1.0 Fixed in 7.1.0 Patch available CNA
  • astro (npm) Vendor— Affected 2.9.0 to before 7.1.0 Fixed in 7.1.0 Patch available GHSA-4g3v-8h47-v7g6

Remediation

  • Fix · CNA astro (withastro) Fixed in 7.1.0
  • Fix · GHSA-4g3v-8h47-v7g6 astro (npm) Fixed in 7.1.0 Advisory →

Red Hat 1 advisory

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Not affected: 1 product
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73422
  2. 2026-10-03 Alias added: GHSA-4g3v-8h47-v7g6
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat

References

Other 5

  • TI-2026-26147 Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` CVSS 3.1CRITICAL 9.1
  • TI-2026-42600 Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch CVSS 3.1HIGH 8.2
  • TI-2024-37142 Server source code is exposed to the public if sourcemaps are enabled CVSS 4.0HIGH 7.8
  • TI-2025-35987 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint CVSS 3.1HIGH 7.2
  • TI-2025-34958 Unauthorized third-party images in Astro’s _image endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-51542 Astro: Unauthenticated path override in the @astrojs/vercel ISR function CVSS 3.1MEDIUM 6.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences