` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass","description":"Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\\/script>/g to…","datePublished":"2026-04-24T16:57:22.940000+00:00","dateModified":"2026-04-24T18:16:55.536000+00:00","inLanguage":"en","author":{"@type":"Organization","@id":"https://vexday.io/#org","name":"Vexday","url":"https://vexday.io","logo":{"@type":"ImageObject","url":"https://vexday.io/icon.png"}},"publisher":{"@type":"Organization","@id":"https://vexday.io/#org","name":"Vexday","url":"https://vexday.io","logo":{"@type":"ImageObject","url":"https://vexday.io/icon.png"}},"mainEntityOfPage":"https://vexday.io/en/cve/CVE-2026-41067","about":{"@type":"SoftwareApplication","name":"withastro astro"},"keywords":"CVE-2026-41067, withastro astro, CWE-79"}
CVE-2026-41067mediumCWE-79

CVE-2026-41067: falha de média gravidade em withastro astro

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

Publicada em

Seguir esta CVE+ Monitorar astro+ Monitorar astro

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.2%
Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
withastro · astro
CVEs relacionadas — withastro astro

No mesmo produto, das mais perigosas para as menos.

CVE-2026-25545MEDIUMAstro has Full-Read SSRF in error rendering via Host: header injectionEPSS 1.9%CVE-2024-56159HIGHServer source code is exposed to the public if sourcemaps are enabledEPSS 1.5%CVE-2025-64525MEDIUMAstro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypassEPSS 1.2%CVE-2025-58179HIGHAstro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpointEPSS 0.9%CVE-2026-84376MEDIUMAstro: Authorization bypass from missing path-segment boundary check when stripping the configured baseEPSS 0.7%CVE-2025-54793MEDIUMAstro: Duplicate trailing slash feature can lead to Open RedirectsEPSS 0.7%