View Transition Animation Vulnerability in Astro Web Framework

CVE-2026-73422

What is CVE-2026-73422?

The Astro web framework, used for content-driven websites, is susceptible to a vulnerability that arises from the server-side View Transition CSS generator improperly handling animation properties. This issue occurs in versions ranging from 2.9.0 to 7.0.9. An attacker can exploit this vulnerability by supplying a malicious animation value, allowing them to terminate the generated style element and inject arbitrary HTML or JavaScript. Successful exploitation requires an on-demand or server-rendered route to process attacker-controlled data in a View Transition animation. As a result, this vulnerability can lead to unauthorized access to sensitive data and execution of harmful scripts in the application’s origin. This vulnerability has been addressed in version 7.1.0.

References