Code Injection in Astro Framework's Unsupported Language Handling
CVE-2026-126365
5.4MEDIUM
What is CVE-2026-126365?
The Astro web framework contains a vulnerability in the way it handles unsupported programming languages in the runHighlighterWithAstro() function. Prior to version 4.1.2 for @astrojs/prism and between versions 0.3.0 to 2.1.2 for @astrojs/markdoc, the framework fails to sanitize output when a requested language lacks a corresponding grammar in Prism. This allows attackers to inject malicious HTML or JavaScript when untrusted code is supplied, potentially leading to content injection. The issue has been resolved in the latest versions of both components, safeguarding users against the risk of code execution via unsanitized input.
Affected Version(s)
astro < 7.4.3
markdoc >= 0.3.0, < 2.1.2
prism < 4.1.2