XSS Vulnerability in Astro Web Framework Affects Multiple Versions
CVE-2026-50146

7.1HIGH

Key Information:

Vendor

Withastro

Status
Astro
Vendor
CVE Published:
22 June 2026

What is CVE-2026-50146?

The Astro web framework, before version 6.3.3, contains a vulnerability where components utilizing a client:* directive inadvertently allow arbitrary HTML injection due to a lack of HTML escaping in the data-astro-template attribute. This enables attackers to exploit reflected cross-site scripting (XSS) during server-side rendering, posing a significant risk to web applications built on this framework.

Affected Version(s)

astro < 6.3.3

References

https://github.com/withastro/astro/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.