XSS Vulnerability in Astro Web Framework Versions Before 6.1.10

CVE-2026-45028

What is CVE-2026-45028?

The Astro web framework, prior to version 6.1.10, contains a vulnerability that allows an attacker to exploit the interaction between server island components. The use of AES-GCM encryption to secure server island props and slots parameters lacks proper binding, enabling an attacker to replay encrypted props as slots and vice versa. This situation poses a risk of XSS attacks, particularly in applications with dynamically rendered pages where props and slots share the same key names. Given that slots can contain raw HTML while props may include user-controlled values, this flaw can lead to the execution of malicious scripts if exploited by an attacker. The vulnerability has been addressed in version 6.1.10.

References