CVE-2026-114128

Awaiting Analysis Awaiting Analysis - Queue

XSS in Astro Framework via JSX/MDX Script Style Children

Publication date: 2026-10-21

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes attacker-controlled data directly as a dynamic child can allow a value containing a closing script or style tag to terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escape dynamic strings automatically; the issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components. Successful exploitation can produce reflected or stored cross-site scripting under the application's origin. This issue is fixed in 7.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114128

EUVD

EUVD-2026-107411

Affected Vendors & Products

Vendor	Product	Version / Range
withastro	astro	< 7.3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Astro web framework versions prior to 7.3.2. It involves improper handling of dynamic content in JSX and MDX script or style elements. Attacker-controlled data passed as children to these elements is rendered as raw HTML without escaping, allowing XSS attacks. For example, a malicious value like '</script><script>alert(1)</script>' could terminate the script tag and inject arbitrary JavaScript.

Detection Guidance

To detect this vulnerability, inspect Astro applications using versions prior to 7.3.2. Check for dynamic content passed directly as children to script or style elements in JSX/MDX files. Use static analysis tools to scan for unescaped dynamic values in these contexts.

Impact Analysis

If you use an affected Astro version, this vulnerability could allow attackers to inject malicious scripts into your web pages. This could lead to reflected or stored cross-site scripting attacks, compromising user data or session tokens. Attackers might steal sensitive information or perform actions on behalf of users without their consent.

Compliance Impact

This vulnerability could lead to data breaches by enabling XSS attacks, which may expose user data. For GDPR, this could result in unauthorized data processing or disclosure, violating principles of data protection. For HIPAA, it might compromise protected health information integrity or confidentiality. Compliance violations could lead to legal penalties or reputational damage.

Mitigation Strategies

Upgrade Astro to version 7.3.2 or later. If upgrading is not immediately possible, ensure all dynamic content passed to script or style elements is properly escaped before rendering. Avoid passing untrusted data directly into these elements.

Hi! I’m here to help you understand CVE-2026-114128. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...