Reflected XSS Vulnerability in Astro Web Framework by WithAstro
CVE-2026-59727

2.1LOW

Key Information:

Vendor

Withastro

Status
Astro
Vendor
CVE Published:
27 July 2026

What is CVE-2026-59727?

Astro web framework versions 3.10.0 through 7.0.3 are susceptible to reflected cross-site scripting (XSS) when utilizing certain directives linked to client-hydrated components. If a developer improperly handles untrusted input by passing it directly into directives like transition:persist, transition:scope, or transition:persist-props, attackers can manipulate these directives to inject harmful HTML or JavaScript into the server-rendered output. This vulnerability arises from the lack of proper HTML escaping of directive values, making it critical for developers to adhere to secure coding practices to ensure that untrusted inputs are adequately validated or sanitized. The vulnerability has been addressed in version 7.0.4.

Affected Version(s)

astro >= 3.10.0, < 7.0.4

References

https://github.com/withastro/astro/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/withastro/astro/pull/17212
x_refsource_MISC
https://github.com/withastro/astro/commit/7ba0bb1dc7516e8...
x_refsource_MISC

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.