What is the CVSS score of CVE-2026-50146?

CVE-2026-50146 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Astro are affected by CVE-2026-50146?

A reflected cross-site scripting vulnerability in Astro framework versions prior to 6.3.3 allows remote attackers to inject malicious JavaScript through SSR-rendered pages when user input is passed…. A patch is available.

How to fix or mitigate CVE-2026-50146?

Within 24 hours: Identify all web applications running Astro versions prior to 6.3.3 and assess their exposure to user-controlled input in component slots. Within 7 days: Deploy Web Application Firewall rules to block XSS payloads; implement mandatory HTML entity encoding for all user-controlled slot names; and enforce restrictive Content Security Policy headers. Within 30 days: Monitor Astro security advisories for patch availability and develop a testing and deployment plan for upgrade to version 6.3.3 or later once released.

Astro CVE-2026-50146

EUVD-2026-38335 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-16 https://github.com/withastro/astro

GHSA-8hv8-536x-4wqp

XSS Node.js

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Reflected XSS reachable over the network without auth but needs victim click (UI:R); injected script in app origin yields scope change with limited C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 22, 2026 - 20:53 NVD

HIGH MEDIUM

CVSS changed

Jun 22, 2026 - 20:53 NVD

7.1 (HIGH) 6.1 (MEDIUM)

Source Code Evidence Fetched

Jun 16, 2026 - 14:50 vuln.today

Analysis Generated

Jun 16, 2026 - 14:50 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on astro (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.3.3.

DescriptionNVD

Summary

When a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR.

This is similar to GHSA-wrwg-2hg8-v723 but exploits a different injection point.

Vulnerable Code

packages/astro/src/runtime/server/render/component.ts:371:376

// component.ts:371
`<template data-astro-template${key !== 'default' ? `="${key}"` : ''}>${children[key]}</template>`

I found that key is interpolated directly into the attribute value without proper escaping.

Proof of Concept

For the PoC, I set up with a minimal repository with Astro 6.3.1, Node.js: v26.0.0.

astro.config.mjs

import react from '@astrojs/react';
import node from '@astrojs/node';
import { defineConfig } from 'astro/config';
export default defineConfig({
  output: 'server',
  adapter: node({ mode: 'standalone' }),
  integrations: [react()],
});

src/pages/index.astro

astro

---
import Wrapper from '../components/Wrapper.jsx';
const slotName = Astro.url.searchParams.get('tab') ?? 'default';
---
<html><body>
  <Wrapper client:load>
    <div slot={slotName}>content</div>
  </Wrapper>
</body></html>

src/components/Wrapper.jsx

jsx

export default function Wrapper() { return null; }

Payload:

abc"></template></astro-island><img src=x onerror=confirm(document.domain)><!--

Accessing this URL will trigger the popup.

http://localhost:4321/?tab=abc%22%3E%3C%2Ftemplate%3E%3C%2Fastro-island%3E%3Cimg+src%3Dx+onerror%3Dconfirm(document.domain)%3E%3C!--

This will render in html.

html

<template data-astro-template="abc"></template></astro-island>
<img src=x onerror=confirm(document.domain)><!--">content</template>

Fix

I suggest leveraging the existing escape function on the slot name.

// component.ts:371
`<template data-astro-template${key !== 'default' ? `="${escapeHTML(String(key))}"` : ''}>${children[key]}</template>`

---

Articles & Coverage 1

News 3 New Node.js Vulnerabilities - 3 High Severity, No Public POC Jun 17, 2026

AnalysisAI

Reflected cross-site scripting in Astro framework (versions prior to 6.3.3) allows remote attackers to inject arbitrary HTML and execute JavaScript in victim browsers when an SSR-rendered page passes user-controlled input as a slot name to a component using a client:* directive. The flaw lives in the server renderer, which interpolates the slot name into a data-astro-template attribute without HTML escaping, enabling attribute-context breakout. No public exploit identified at time of analysis beyond the reporter's PoC in the GHSA advisory, and the issue is not listed in CISA KEV.

Technical ContextAI

Astro is a server-side rendering web framework (pkg:npm/astro) that hydrates interactive islands using client:* directives such as client:load. During SSR, packages/astro/src/runtime/server/render/component.ts builds a <template data-astro-template="KEY"> wrapper for each named slot, but the KEY value is template-literal-interpolated directly into the attribute without passing through the existing escapeHTML helper. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) instance where an output-encoding control is missing at a specific attribute sink, allowing an attacker who can influence the slot name (typically via a query parameter that feeds slot={...}) to close the attribute, the <template>, and the surrounding <astro-island>, then inject arbitrary tags such as <img src=x onerror=...>.

RemediationAI

Upgrade the astro npm package to version 6.3.3 or later, which adds HTML escaping of the slot name in packages/astro/src/runtime/server/render/component.ts as described in the GHSA-8hv8-536x-4wqp advisory (https://github.com/withastro/astro/security/advisories/GHSA-8hv8-536x-4wqp). If immediate upgrade is not possible, audit .astro pages for patterns where slot={...} is bound to values derived from Astro.url.searchParams, request bodies, headers, or other untrusted sources, and either hard-code the slot name, validate it against an allowlist of known slot identifiers, or wrap it with a manual HTML escape before passing it to the component - note that simply removing the client:* directive disables interactive hydration for that island and may regress UI behavior. A Content-Security-Policy without unsafe-inline can reduce impact of injected scripts but will not stop HTML-only payloads such as <img onerror>.