Injection Vulnerability in Astro Framework's @astrojs/solid-js Renderer

CVE-2026-126363

What is CVE-2026-126363?

The Astro framework's @astrojs/solid-js renderer contains a vulnerability that allows for an injection of active HTML through unescaped named slots. This vulnerability affects versions 0.2.0 through 7.1.2, where a crafted request can manipulate the slot name attribute, potentially leading to unintended rendering of HTML content. Exploitation requires specific conditions involving hydrated Solid components and client:* directives, as well as access to dynamically defined slot properties. Components not rendering the affected slot will only output escaped content, reducing the immediate risk. The issue has been addressed in version 7.1.2.

References