Astro EUVD-2026-107409

Exploitation requires the Astro application (versions 7.1.0 through 7.3.2) to pass attacker-controlled data into a server-side View Transition animation property - specifically duration, delay, easing, direction, fillMode, or the animation name - which the pre-patch CSS generator serializes without escaping the ';', '{', and '}' delimiters. This is a non-default, application-level condition: stock Astro with hardcoded transition values is not exploitable. Impact is further limited by the framework still escaping literal less-than characters (preventing style-element breakout, HTML, or JavaScript injection), by the need for a victim to load the crafted server-rendered page (passive user interaction), and by confining the outcome to CSS-level UI manipulation and at most exfiltration of data already present in selectable DOM attributes.

This is a genuinely low-priority issue, and the multiple signals agree rather than conflict. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N) scores 2.3 (Low), reflecting that while the attack is network-reachable and unauthenticated, it carries an attack requirement (AT:P) and passive user interaction (UI:P), with only Low confidentiality and integrity impact and no availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data - only the upstream patch PR and its regression tests, which demonstrate the fix but are not a weaponized POC. Critically, the CWE-79 classification and the 'XSS' tag overstate the danger: the description explicitly notes that literal less-than characters remain escaped, so the flaw cannot terminate the style element or inject HTML/JavaScript. The real-world impact is confined to CSS injection (UI spoofing, content concealment/repositioning, and at most conditional exfiltration of data already in selectable DOM attributes). The most important limiting factor is not captured by CVSS: exploitation requires the hosting application to deliberately pass attacker-controlled data into View Transition animation properties - a non-default, application-specific coding pattern - so most Astro deployments are not exposed at all.

An Astro application (7.1.0-7.3.2) server-renders a page that interpolates untrusted user input - for example a URL parameter or stored field - directly into a View Transition animation property such as duration, delay, easing, or the animation name. The attacker supplies a value containing CSS delimiters (';', '}', '{') to break out of the generated declaration and inject their own CSS rules, which a victim then loads as part of the server-rendered stylesheet. No public exploit code was identified at time of analysis; the attacker could overlay or hide interface elements to spoof the UI, and in some apps use conditional resource loads to leak attribute data already present in the DOM.