CVE-2026-59729 Details
Description
Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.
A cross-site scripting (XSS) vulnerability has been identified in the Astro web framework, specifically in versions prior to 7.0.6. The issue arises in the renderHTMLElement function, where unescaped spread attribute names can lead to the injection of arbitrary markup or event-handler attributes, breaking out of the intended attribute context. This vulnerability is present when a component that extends native HTMLElement is used with untrusted prop keys that are spread onto it.
Users can update to Astro version 7.0.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 27, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d | [email protected] | Source CodeVendor |
| https://github.com/withastro/astro/pull/17251 | [email protected] | Source CodeVendor |
| https://github.com/withastro/astro/releases/tag/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Astro | <= 7.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |