Dynamic Element Name Injection Vulnerability in Astro Web Framework by WithAstro

CVE-2026-126361

What is CVE-2026-126361?

Astro, a popular web framework designed for content-driven websites, is susceptible to a vulnerability that allows the injection of event-handler markup through untrusted element-name inputs. This arises from the framework's improper filtering of dynamic element names, which can lead to an HTML parser misinterpreting part of the input as attributes. The vulnerability impacts the .astro dynamic-tag, JSX, and MDX renderers, necessitating the presence of request-controlled or stored untrusted data as a portion of the element name to exploit the issue. The vulnerability has been addressed in version 7.4.5.

References