CVE-2026-59727 Details
Description
Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.
A reflected cross-site scripting vulnerability has been identified in the Astro web framework, specifically in versions 3.10.0 prior to 7.0.4. The issue arises when a transition directive is applied to a client-hydrated component. Astro fails to HTML-escape the directive values before rendering them on the <astro-island> element. This oversight allows an attacker to inject arbitrary HTML or JavaScript into the server-rendered output, exploiting applications that improperly handle untrusted input in these directives.
Users can upgrade to Astro version 7.0.4 or later, which addresses the vulnerability by ensuring that transition directive values are properly HTML-escaped before being rendered on the island element. For those unable to upgrade, it's advised to avoid passing untrusted or request-derived input into the affected transition directives.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 27, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294 | [email protected] | Source CodeVendor |
| https://github.com/withastro/astro/pull/17212 | [email protected] | Source CodeVendor |
| https://github.com/withastro/astro/releases/tag/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Astro | >= 3.10.0, < 7.0.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |