Astro Framework CVE-2026-114128

Exploitation requires the target application to pass attacker-controlled data as a DYNAMIC child of a <script> or <style> element rendered through the astro:jsx renderer (including MDX components) - e.g. <script>{value}</script> or <style>{value}</style> - where the attacker can influence that value via request input or stored data. The flaw does NOT affect compiler-generated literal script/style content or content injected by remark/rehype plugins, and does NOT affect other JSX expression contexts, which already escape dynamic strings. Limiting factors: the vulnerable coding pattern is developer-introduced (not a default configuration), the victim must load the affected page (UI:R), and only astro:jsx/MDX rendering paths prior to Astro 7.3.2 are affected; using set:html is the sanctioned opt-in for raw rendering.

This is a moderate, developer-dependent XSS (CWE-79) in the Astro framework's astro:jsx/MDX renderer, scored CVSS 6.5 (NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). The vector signals network reach, low complexity, no attacker privileges, but required user interaction (victim must load the page). No EPSS score, KEV entry, or SSVC decision data was supplied, so probabilistic and automatable signals cannot be evaluated - treat exploitation likelihood as unquantified. Critically, this is NOT a flaw exploitable against default/unmodified Astro installs: it only triggers when the application developer passes attacker-controlled data as a dynamic child of a <script> or <style> element (e.g. <script>{value}</script>) rendered through astro:jsx, including MDX components. All other JSX expression contexts already auto-escape, which sharply narrows the real-world attack surface. The public fix PR (#17896) ships a functional payload fixture ('</script><script id="script-owned">window.__pwned = true</script>'), so working exploit input is effectively public even though no CISA KEV or in-the-wild exploitation is indicated. Net: a genuine but conditional priority - high if your app renders untrusted data into script/style children, low otherwise. Note the PR:N in the vector reflects the victim/attacker-less web context, not that every Astro site is exploitable.

A developer builds an Astro/MDX page that interpolates user- or request-derived data directly into a script or style child, e.g. <script>{userValue}</script>. An attacker submits a value containing '</script><script>...</script>' (or '</style>...'), which closes the element early and injects attacker JavaScript; when a victim loads the page, the script runs under the application's origin (reflected or stored XSS). A working payload demonstrating this is already published in the fix PR's test fixture.