CVE-2026-126362
Received Received - Intake

Astro Framework @astrojs/svelte Slot Name HTML Injection

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126362

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
astro astro From 5.7.3 (inc) to 9.1.2 (exc)
astrojs svelte From 5.7.3 (inc) to 9.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a reflected Cross-Site Scripting (XSS) issue in the Astro framework's Svelte integration. It occurs because slot names passed to Svelte components are not properly HTML-escaped when rendered in an astro-slot element's name attribute. Attackers can exploit this by injecting malicious JavaScript code via crafted slot names, such as query parameters, which execute when the slot is rendered.

Detection Guidance

To detect this vulnerability, check the version of @astrojs/svelte in use. If it is between 5.7.3 and 9.1.1, the system is vulnerable. Use commands like 'npm list @astrojs/svelte' or 'yarn list @astrojs/svelte' to verify the installed version.

Impact Analysis

If exploited, this vulnerability could allow attackers to inject and execute malicious JavaScript code in a user's browser when they visit a vulnerable Astro site. This could lead to theft of session cookies, account takeovers, or defacement of the website. Exploitation requires specific conditions like request-controlled slot names and a Svelte component using client:* directives.

Compliance Impact

This vulnerability enables reflected Cross-Site Scripting (XSS) attacks by allowing malicious JavaScript injection through crafted slot names. Such attacks could lead to unauthorized data access, manipulation, or exfiltration, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade @astrojs/svelte to version 9.1.2 or later immediately. This can be done using 'npm update @astrojs/svelte' or 'yarn upgrade @astrojs/svelte'. Avoid using request-controlled input as slot names until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...