Server-side View Transition CSS Generator Vulnerability in Astro Web Framework

CVE-2026-114127

What is CVE-2026-114127?

The Astro web framework released versions 7.1.0 to 7.3.3 contains a vulnerability in its server-side View Transition CSS generator. This flaw allows for the injection of arbitrary CSS rules if an application improperly handles attacker-controlled data within various animation properties such as duration, delay, easing, direction, fillMode, or animation names. Although this injection does not permit the termination of style elements or direct HTML or JavaScript injection, it can conceal or reposition elements, as well as misrepresent the user interface. This could result in data exposure via selectable DOM attributes when conditional resource loads are employed. The issue is resolved in version 7.3.3.

References