Astro CVE-2026-41067
MEDIUM
GHSA-j687-52p2-xcff
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible reflected XSS needing no auth (PR:N) but requiring victim to load a crafted URL (UI:R); scope changes to browser context (S:C) with limited C/I impact and no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Summary
The defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript.
Details
The vulnerable function is defineScriptVars at packages/astro/src/runtime/server/render/util.ts:42-53:
export function defineScriptVars(vars: Record<any, any>) {
let output = '';
for (const [key, value] of Object.entries(vars)) {
output += `const ${toIdent(key)} = ${JSON.stringify(value)?.replace(
/<\/script>/g, // ← Case-sensitive, exact match only
'\\x3C/script>',
)};\n`;
}
return markHTMLString(output);
}This function is called from renderElement at util.ts:172-174 when a <script> element has define:vars:
if (name === 'script') {
delete props.hoist;
children = defineScriptVars(defineVars) + '\n' + children;
}The regex /<\/script>/g fails to match three classes of closing script tags that HTML parsers accept per the HTML specification §13.2.6.4:
- Case variations:
</Script>,</SCRIPT>,</sCrIpT>- HTML tag names are case-insensitive but the regex has noiflag. - Whitespace before
>:</script >,</script\t>,</script\n>- after the tag name, the HTML tokenizer enters the "before attribute name" state on ASCII whitespace. - Self-closing slash:
</script/>- the tokenizer enters "self-closing start tag" state on/.
JSON.stringify() does not escape <, >, or / characters, so all these payloads pass through serialization unchanged.
Execution flow: User-controlled input (e.g., Astro.url.searchParams) → assigned to a variable → passed via define:vars on a <script> tag → renderElement → defineScriptVars → incomplete sanitization → injected into <script> block in HTML response → browser closes the script element early → attacker-controlled HTML parsed and executed.
PoC
Step 1: Create an SSR Astro page (src/pages/index.astro):
---
const name = Astro.url.searchParams.get('name') || 'World';
---
<html>
<body>
<h1>Hello</h1>
<script define:vars={{ name }}>
console.log(name);
</script>
</body>
</html>Step 2: Ensure SSR is enabled in astro.config.mjs:
export default defineConfig({
output: 'server'
});Step 3: Start the dev server and visit:
http://localhost:4321/?name=</Script><img/src=x%20onerror=alert(document.cookie)>Step 4: View the HTML source. The output contains:
<script>const name = "</Script><img/src=x onerror=alert(document.cookie)>";
console.log(name);
</script>The browser's HTML parser matches </Script> case-insensitively, closing the script block. The <img onerror=alert(document.cookie)> is then parsed as HTML and the JavaScript in onerror executes.
Alternative bypass payloads:
/?name=</script ><img/src=x onerror=alert(1)>
/?name=</script/><img/src=x onerror=alert(1)>
/?name=</SCRIPT><img/src=x onerror=alert(1)>Impact
An attacker can execute arbitrary JavaScript in the context of a victim's browser session on any SSR Astro application that passes request-derived data to define:vars on a <script> tag. This is a documented and expected usage pattern in Astro.
Exploitation enables:
- Session hijacking via cookie theft (
document.cookie) - Credential theft by injecting fake login forms or keyloggers
- Defacement of the rendered page
- Redirection to attacker-controlled domains
The vulnerability affects all Astro versions that support define:vars and is exploitable in any SSR deployment where user input reaches a define:vars script variable.
Recommended Fix
Replace the case-sensitive exact-match regex with a comprehensive escape that covers all HTML parser edge cases. The simplest correct fix is to escape all < characters in the JSON output:
export function defineScriptVars(vars: Record<any, any>) {
let output = '';
for (const [key, value] of Object.entries(vars)) {
output += `const ${toIdent(key)} = ${JSON.stringify(value)?.replace(
/</g,
'\\u003c',
)};\n`;
}
return markHTMLString(output);
}This is the standard approach used by frameworks like Next.js and Rails. Replacing every < with \u003c is safe inside JSON string contexts (JavaScript treats \u003c as < at runtime) and eliminates all possible </script> variants including case variations, whitespace, and self-closing forms.
AnalysisAI
Reflected XSS in Astro's SSR pipeline allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by bypassing the incomplete </script> tag sanitization in the defineScriptVars function. All Astro versions prior to 6.1.6 running in SSR mode are affected when user-controlled input reaches a define:vars script block - a documented and common usage pattern. A detailed public proof-of-concept is available via GHSA-j687-52p2-xcff; EPSS is low (0.03%, 8th percentile) consistent with the required victim interaction, and no CISA KEV listing indicates no confirmed mass exploitation at time of analysis.
Technical ContextAI
Astro is a JavaScript web framework distributed as the astro npm package (pkg:npm/astro) for building server-rendered and static websites. In SSR mode, the defineScriptVars function at packages/astro/src/runtime/server/render/util.ts:42-53 serializes server-side variables into inline <script> blocks by calling JSON.stringify() and then applying a regex substitution. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the sanitization regex /</script>/g lacks the i flag and does not account for the full HTML tokenizer behavior specified in HTML §13.2.6.4, which closes script elements on case-insensitive tag names (</Script>, </SCRIPT>), tag names followed by whitespace (</script >), and self-closing slash forms (</script/>). Because JSON.stringify() does not escape <, >, or / characters, all three bypass classes pass through serialization and into the HTML response unmodified, where the browser's HTML parser closes the script element early and processes attacker-supplied markup.
RemediationAI
Upgrade the Astro npm package to version 6.1.6 or later, which corrects the sanitization logic via commit b06eabf to properly handle all closing script tag variants. See the release notes at https://github.com/withastro/astro/releases/tag/astro@6.1.6 and the full security advisory at https://github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff. If an immediate upgrade is not possible, the most effective compensating control is to avoid passing any request-derived data (from Astro.url.searchParams, Astro.request.headers, or Astro.cookies) directly to define:vars on <script> tags without prior allowlist validation - this eliminates the attack surface without requiring a framework change, though it requires auditing all SSR pages. A WAF rule blocking case-insensitive </script patterns in query parameters is a lower-fidelity option that may produce false positives for legitimate URL content. There is no known availability impact from upgrading; the fix is a sanitization-only change.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today