CVE-2026-59729mediumCWE-79

CVE-2026-59729: medium-severity vulnerability in withastro astro

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Published · Updated

Follow this CVE+ Monitor astro+ Monitor astro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.5%
Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
withastro · astro
Related CVEs — withastro astro

In the same product, most dangerous first.

CVE-2026-25545MEDIUMAstro has Full-Read SSRF in error rendering via Host: header injectionEPSS 1.9%CVE-2024-56159HIGHServer source code is exposed to the public if sourcemaps are enabledEPSS 1.5%CVE-2025-64525MEDIUMAstro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypassEPSS 1.2%CVE-2025-58179HIGHAstro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpointEPSS 0.9%CVE-2026-84376MEDIUMAstro: Authorization bypass from missing path-segment boundary check when stripping the configured baseEPSS 0.7%CVE-2025-54793MEDIUMAstro: Duplicate trailing slash feature can lead to Open RedirectsEPSS 0.7%