CVE-2026-114127

Awaiting Analysis Awaiting Analysis - Queue

Astro Framework CSS Injection via View Transition

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, delay, easing, direction, fillMode, or animation names can allow CSS delimiters to terminate the declaration and add attacker-selected rules to the server-rendered page. The generated stylesheet still escapes literal less-than characters, so the injected content cannot terminate the style element or directly inject HTML or JavaScript. The injected CSS can conceal or reposition content, add generated text, and otherwise misrepresent the interface; some applications may also expose data already present in selectable DOM attributes through conditional resource loads. This issue is fixed in 7.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114127

EUVD

EUVD-2026-107409

Affected Vendors & Products

Vendor	Product	Version / Range
withastro	astro	>= 7.1.0, < 7.3.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects Astro versions 7.1.0 to 7.3.2. It involves improper handling of animation properties in View Transitions, allowing attacker-controlled data to inject malicious CSS into server-rendered pages. The issue occurs because CSS delimiters like semicolons and braces are not escaped, enabling termination of CSS declarations and insertion of new rules. The injected CSS remains within the style element and cannot execute JavaScript or inject HTML directly.

Detection Guidance

Check Astro version with 'npm list astro' or 'astro --version'. If using 7.1.0 to 7.3.2, the system is vulnerable. Inspect server-rendered HTML for injected CSS in transition animations by reviewing style elements for unexpected rules.

Impact Analysis

An attacker could exploit this to restyle page content, reposition elements, or conceal UI elements. This could mislead users or hide malicious actions. Exploitation requires an application to pass untrusted data into animation properties, which is uncommon. No direct data exposure like cookies or server data occurs.

Mitigation Strategies

Upgrade Astro to version 7.3.3 or later immediately. Avoid passing untrusted data into animation properties like duration, delay, or easing. Validate all user-controlled input used in transitions strictly.

Hi! I’m here to help you understand CVE-2026-114127. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...