HTML Injection Vulnerability in Astro Web Framework Affects @astrojs/svelte Renderer

CVE-2026-126362

What is CVE-2026-126362?

The Astro web framework, specifically versions 5.7.3 to 9.1.2 of the @astrojs/svelte renderer, exhibits a vulnerability where user-controlled input can lead to HTML injection via named slots. This occurs because slot names are inserted into the quoted name attribute of an astro-slot wrapper without proper HTML escaping, allowing an attacker to terminate the attribute and execute arbitrary HTML. Successful exploitation requires a hydrated Svelte component that employs a client:* directive and dynamically renders a slot specified by the attacker. Components that do not render that specific slot will only emit Astro's fallback content, which is safely escaped. This vulnerability has been addressed in version 9.1.2, ensuring that slot names are now adequately sanitized to prevent exploitation.

References