[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	7.3.1 → 7.3.3

---

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

CVE-2026-114128 / GHSA-98hj-9722-w3j8

More information

Details

Summary

Astro's JSX and MDX rendering pipeline treated string children of <script> and <style> elements as trusted HTML. When a dynamic value was passed through a JSX expression, such as <script>{value}</script>, an attacker-controlled value containing </script> or </style> could terminate the element and inject arbitrary HTML and JavaScript.

Other JSX expression contexts escaped dynamic strings automatically. This behavior was limited to <script> and <style> children rendered through Astro's astro:jsx renderer, including MDX components.

Details

The affected rendering paths marked all string children of <script> and <style> elements as safe HTML, without distinguishing literal content generated by the compiler from dynamic expression values. An application was vulnerable when attacker-controlled data, such as a query parameter or CMS field, was interpolated directly into one of these elements.

For example, a value containing </script><script>alert(1)</script> passed to <script>{value}</script> was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script.

The fix preserves raw rendering for literal script and style content while escaping dynamic string children like other JSX expression values.

Impact

Affected applications could be vulnerable to reflected or stored cross-site scripting. Exploitation required an application to pass attacker-controlled data directly as a dynamic child of a <script> or <style> element in MDX or through the astro:jsx runtime. Successful exploitation allowed arbitrary JavaScript execution in the victim's browser under the application's origin.

Patches

This issue is patched in astro@7.3.2.

Workarounds

Do not interpolate untrusted dynamic values directly into <script> or <style> element children. Applications that cannot upgrade should validate and contextually encode these values before rendering them.

Credit

Reported by @​RKasai127.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

• https://github.com/withastro/astro/security/advisories/GHSA-98hj-9722-w3j8
• https://nvd.nist.gov/vuln/detail/CVE-2026-114128
• https://github.com/withastro/astro/pull/17896
• https://github.com/withastro/astro/commit/a548223607b9bb146d5d90ddda495343f9a2a739
• https://github.com/withastro/astro
• https://github.com/withastro/astro/releases/tag/astro@7.3.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Astro: Arbitrary CSS injection in Astro View Transitions

CVE-2026-114127 / GHSA-mpr7-6m5w-76rw

More information

Details

Summary

Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page.

The injected content remains inside the generated <style> element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes < before emitting the stylesheet.

Severity

Exploitation requires an application to pass untrusted, request-derived, or user-controlled content directly into a transition animation value. This is an uncommon application pattern, and applications using static or otherwise trusted transition values are unaffected.

The resulting capability is limited to CSS in the rendered document. The proof of concept does not demonstrate JavaScript execution, HTML injection, an origin-boundary bypass, or access to server-only data.

Details

Animation values are collected by stringifyAnimations() in packages/astro/src/runtime/server/transition.ts and passed to addAnimationProperty(). String values were converted directly with toString():

function addAnimationProperty(builder: AnimationBuilder, prop: string, value: string | number) {
  let arr = builder[prop];
  if (Array.isArray(arr)) {
    arr.push(value.toString());
  } else {
    builder[prop] = [value.toString()];
  }
}

The animation builder then interpolated each value into a declaration:

out += `\n\t${k}: ${value.join(', ')};`;

The completed stylesheet passes through escapeStyleText(), which escapes literal < characters to keep the content inside its HTML <style> element. CSS delimiters such as ;, {, and } remained active, allowing a value to escape its intended declaration and add another rule.

The shared serializer handles duration, delay, easing, direction, fillMode, and animation names, so custom transition objects using those string properties followed the same path.

The fix encodes CSS declaration delimiters while serializing each animation value. Supported CSS functions and strings, including calc() and var(), remain unchanged.

Proof of Concept

Using astro@7.3.2, create an on-demand rendered page:

---
import { fade } from "astro:transitions";
const duration = Astro.url.searchParams.get("duration") ?? "1ms";
---
<div id="target" transition:animate={fade({ duration })}>SAFE</div>

Request the page with:

/?duration=1ms%3B%7D%23target%7Bcolor%3Argb(1%2C2%2C3)%3Bfont-size%3A37px%7Dx%7Banimation-duration%3A1ms

Before the fix, the generated stylesheet contains an active rule equivalent to:

#target {
  color: rgb(1, 2, 3);
  font-size: 37px;
}

In Chromium, the target's computed styles change to rgb(1, 2, 3) and 37px. This behavior is reproducible in a production standalone SSR build, not only in the development server.

Impact

An attacker can inject CSS into the affected application's rendered page when the application places attacker-controlled data into a transition animation value. The CSS can restyle or conceal content, reposition existing controls, add generated text, or otherwise misrepresent the page's UI.

CSS selectors and conditional resource loads may expose data already present in selectable DOM attributes in some applications, depending on the page and its Content Security Policy. The issue does not expose cookies, server-only values, arbitrary DOM text, or cross-origin response data by itself.

Affected Versions

astro >= 7.1.0, <= 7.3.2.

Versions through 7.0.9 are covered by GHSA-4g3v-8h47-v7g6 / CVE-2026-73422, which had the stronger impact of escaping the <style> element and injecting HTML or JavaScript.

Patched Versions

This issue is patched in astro@7.3.3. Fix: https://github.com/withastro/astro/pull/17970

Workarounds

Do not pass untrusted or request-derived values into View Transition animation properties. If dynamic values are required, validate them according to the expected CSS grammar before constructing the transition. For duration and delay, prefer finite numbers or strictly validated CSS time values.

Credits

Reported by @​avrlab233.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/withastro/astro/security/advisories/GHSA-mpr7-6m5w-76rw
• https://nvd.nist.gov/vuln/detail/CVE-2026-114127
• https://github.com/withastro/astro/pull/17970
• https://github.com/withastro/astro/commit/0b4dc3a211910b589d3805ab4dfedf11b0e712bb
• https://github.com/withastro/astro
• https://github.com/withastro/astro/releases/tag/astro@7.3.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

withastro/astro (astro)

v7.3.3

Compare Source

Patch Changes

• #​17651 504333c Thanks @​sxzz! - Refactors internal version handling to use a smaller, ESM-native dependency

• #​17942 0bc5715 Thanks @​matthewp! - Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths

• #​17700 b2222fc Thanks @​winklemad! - Fixes Astro.preferredLocaleList returning an empty list when a locale is configured with the object form ({ path, codes }) and the browser sends the code with different casing or an underscore, such as en-US matching a configured en-us

• #​17941 394ff79 Thanks @​matthewp! - Fixes astro preview --ignore-lock (and astro dev --ignore-lock) being refused when run from an AI agent environment. The flag now starts the server in the foreground instead of erroring, since agent detection only inferred background mode and was never explicitly requested. An explicit --background combined with --ignore-lock still errors.

• #​17928 3277927 Thanks @​ArmandPhilippot! - Fixes TypeScript autocompletion for getImage() to suggest all available predefined options.

• #​17928 3277927 Thanks @​ArmandPhilippot! - Fixes a type error in getImage() options that allowed passing both widths and densities at the same time.

• #​17857 2637ed1 Thanks @​Princesseuh! - Improves rendering performance

• #​17943 2fc7ce9 Thanks @​matthewp! - Fixes a WebAssembly error when importing astro:actions in tests that run under @cloudflare/vitest-pool-workers

• #​18018 1b5a234 Thanks @​astro-factory! - Fixes trailing-slash redirect response body pointing to the incoming URL instead of the redirect target. The location header was correct, but the HTML body (<meta http-equiv="refresh">, <title>, and <a> tag) contained the original request path without the trailing-slash correction or query string.

• #​17905 eaf70fa Thanks @​SudoDevStudio! - Fixes custom dev toolbar apps losing their UI after client-side navigation with <ClientRouter />.

• #​18011 558b301 Thanks @​astro-factory! - Fixes prerendered Cloudflare pages rendering as [object Object] when nodejs_compat is enabled in wrangler.toml

• #​17944 ba08e35 Thanks @​matthewp! - Fixes a regression in astro dev where writes outside the module graph (for example, @astrojs/cloudflare's .wrangler/state files) invalidated the middleware on every request, causing repeated SSR reloads. Such writes no longer invalidate the middleware.

• #​17531 ae837db Thanks @​danilloestrela! - Updates svgo to 4.0.2 to resolve a security advisory

• #​17953 dbbf10e Thanks @​astro-factory! - Fixes a one-time page reload shortly after the first load on cold dev-server starts when a project has framework components imported from MDX content entries. MDX files are now included in the dev dependency pre-bundling scan, so their framework dependencies are bundled up front instead of being discovered (and reloaded for) at runtime.

• #​17955 4e8ad9a Thanks @​matthewp! - Improves dev server startup time. The content config and dev server app module graphs now begin compiling during server creation without blocking the server from listening. Request handling waits for the shared setup result when needed, cutting astro dev ready time by roughly a third on projects with a content config.

• #​17960 9838049 Thanks @​Chy-Zaber-Bin-Zahid! - Improves the diagnostics of some Astro errors.

• #​17998 0e5478d Thanks @​astro-factory! - Fixes SVG <style> elements nested inside <defs> or other container elements not being hashed for CSP

• #​17994 80f9f1d Thanks @​astro-factory! - Fixes experimental.incrementalBuild restoring pages with stale CSS after a preprocessor partial changes or missing original images referenced by restored pages

• #​17889 8ae6b46 Thanks @​ajfAfg! - Fixes a bug where the dev server stripped the configured base from URLs that only share a prefix with it. With base: '/s', requests to /src/... were rewritten to /rc/... and failed, breaking those pages during development.

• #​17980 cfccafa Thanks @​gameroman! - Improves JSDoc for fonts api

• #​17953 dbbf10e Thanks @​astro-factory! - Fixes CSS HMR for framework components rendered through content entries after ClientRouter navigation

• #​17970 0b4dc3a Thanks @​matthewp! - Improves serialization of transition animation values in generated CSS

• #​17999 30ef3cb Thanks @​astro-factory! - Fixes content collection HMR not updating prerendered pages when an adapter enables a separate prerender environment (e.g. @astrojs/cloudflare with prerenderEnvironment: 'node')

• #​18002 312ab49 Thanks @​shoutoutuoadi325! - Fixes redirect targets being corrupted when a dynamic route parameter value contains $ replacement patterns like $&

• #​17937 e294953 Thanks @​matthewp! - Fixes a bug where the glob() content loader kept stale entries in the data store after the last file in a collection was deleted. Empty collections are now pruned correctly, and the file watcher is registered in dev so the first file added to an empty collection is picked up without a restart.

• #​17945 750b4db Thanks @​matthewp! - Pre-bundles renderer server entrypoints and the default console logger during dev so they are included in the initial optimization pass, preventing a mid-request re-optimization that could crash the dev server on Cloudflare (workerd).

v7.3.2

Compare Source

Patch Changes

• #​17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #​17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #​17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #​17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@0.4.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[wiz-inc-38d59fb8d7]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	4  1
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	4  1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.