CVE-2026-114128: Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes attacker-controlled data directly as a dynamic child can allow a value containing a closing script or style tag to terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escape dynamic strings automatically; the issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components. Successful exploitation can produce reflected or stored cross-site scripting under the application's origin. This issue is fixed in 7.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Astroto a version that resolves this vulnerability.Fixed in 7.3.2
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Astro versions before 7.3.2 are exposed only if they render attacker-controlled data as a dynamic child of a script or style element through the astro:jsx renderer. This includes affected JSX and MDX components; other JSX expression contexts automatically escape dynamic strings.
What does an attacker need to exploit it?
An attacker needs a way to supply data that the application passes directly into a dynamic script or style child. The supplied value must contain a closing script or style tag that terminates the intended element and permits injection of arbitrary HTML and JavaScript.
Are applications affected by default?
No default exposure is stated. Exploitation depends on application code rendering attacker-controlled dynamic values inside script or style elements, rather than merely using Astro, JSX, or MDX.
How can teams remediate the issue?
Upgrade Astro to version 7.3.2. Until upgrading, do not pass untrusted data as dynamic children of script or style elements in JSX or MDX components; avoid rendering such values through the astro:jsx renderer.