Cross-Site Scripting Vulnerability in Astro Web Framework Affecting Script and Style Elements

CVE-2026-114128

What is CVE-2026-114128?

Astro, a web framework designed for content-driven sites, has a vulnerability in its JSX and MDX rendering pipeline. Prior to version 7.3.2, the framework fails to properly handle string children of script and style elements, treating them as trusted HTML. This flaw permits applications to accept attacker-controlled dynamic data, potentially leading to injection of malicious HTML or JavaScript. If an attacker can control the data passed to these elements, they can exploit this issue to execute reflected or stored cross-site scripting attacks. The threat is specifically present in the script and style children processed through the astro:jsx renderer. The vulnerability has been addressed in the release of version 7.3.2.

References