CVE-2026-50146

Published: Jun 22, 2026Modified: Jun 23, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.

Affected (1)

Products: Astro: Astro

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Astro Astro	Before 6.3.3

Related CWEs

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References (2)

https://github.com/withastro/astro/security/advisories/GHSA-8hv8-536x-4wqp

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/withastro/astro/security/advisories/GHSA-8hv8-536x-4wqp

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

Timeline

No history available yet.