CVE-2026-126361: Astro: XSS via attribute injection in dynamic tag names
Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Astroto a version that resolves this vulnerability.Fixed in 7.4.5
Event History
Frequently Asked Questions
Which applications are actually exposed to this issue?
Applications using Astro before 7.4.5 are exposed only if they use request-controlled or stored untrusted data as all or part of a dynamic element name. The affected rendering paths are the .astro dynamic-tag renderer, JSX renderer, and MDX renderer.
What does an attacker need to exploit it?
An attacker needs control over data that the application incorporates into a dynamic element name. A slash in that value can cause the HTML parser to interpret the remainder as attributes, enabling injection of event-handler markup.
Are applications using only fixed element names affected?
No. Exploitation requires untrusted input to be used as all or part of an element name; applications limited to fixed, trusted element names do not meet the stated exploitation condition.
What version fixes the vulnerability?
Upgrade Astro to version 7.4.5, which fixes the incomplete filtering that allowed the dynamic element-name value to be rendered as raw HTML.