` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass","description":"Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\\/script>/g to…","datePublished":"2026-04-24T16:57:22.940000+00:00","dateModified":"2026-04-24T18:16:55.536000+00:00","inLanguage":"en","author":{"@type":"Organization","@id":"https://vexday.io/#org","name":"Vexday","url":"https://vexday.io","logo":{"@type":"ImageObject","url":"https://vexday.io/icon.png"}},"publisher":{"@type":"Organization","@id":"https://vexday.io/#org","name":"Vexday","url":"https://vexday.io","logo":{"@type":"ImageObject","url":"https://vexday.io/icon.png"}},"mainEntityOfPage":"https://vexday.io/en/cve/CVE-2026-41067","about":{"@type":"SoftwareApplication","name":"withastro astro"},"keywords":"CVE-2026-41067, withastro astro, CWE-79"}
CVE-2026-41067mediumCWE-79

CVE-2026-41067: medium-severity vulnerability in withastro astro

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

Published

Follow this CVE+ Monitor astro+ Monitor astro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.2%
Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
withastro · astro
Related CVEs — withastro astro

In the same product, most dangerous first.

CVE-2026-25545MEDIUMAstro has Full-Read SSRF in error rendering via Host: header injectionEPSS 1.9%CVE-2024-56159HIGHServer source code is exposed to the public if sourcemaps are enabledEPSS 1.5%CVE-2025-64525MEDIUMAstro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypassEPSS 1.2%CVE-2025-58179HIGHAstro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpointEPSS 0.9%CVE-2026-84376MEDIUMAstro: Authorization bypass from missing path-segment boundary check when stripping the configured baseEPSS 0.7%CVE-2025-54793MEDIUMAstro: Duplicate trailing slash feature can lead to Open RedirectsEPSS 0.7%