CVE-2026-126363
Received Received - Intake

Solid-JS Renderer HTML Injection in Astro Framework

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Solid component using a client:* directive and dynamic access to the attacker-chosen slot property; a component that did not render that slot emitted only escaped fallback content. This issue is fixed in version 7.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126363

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
astrojs solid-js From 0.2.0 (inc) to 7.1.2 (exc)
astrojs solid-js 7.1.2
astrojs solid-js From 0.2.0 (inc) to 7.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a reflected Cross-Site Scripting (XSS) issue in the Astro framework's @astrojs/solid-js renderer. It occurs when a named slot's name attribute is inserted without HTML escaping, allowing attackers to inject malicious HTML or JavaScript by including a quote character in the slot name. For example, a slot name like x"><img src=x onerror=alert(1)> could execute arbitrary code when rendered.

Detection Guidance

Check Astro and @astrojs/solid-js versions. Run: npm list astro @astrojs/solid-js. If versions are below 7.1.2, the system is vulnerable. Inspect Solid.js components using client:* directives with dynamic slot rendering.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in a user's browser when visiting a vulnerable page. This could lead to theft of session cookies, sensitive data, or unauthorized actions on behalf of the user. Exploitation requires specific conditions: user-controlled input as a slot name, a hydrated Solid component with a client:* directive, and dynamic rendering of the slot.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade @astrojs/solid-js to version 7.1.2 or later. Avoid using request-controlled input as slot names until patched. Review components for hydrated Solid.js with client:* directives and dynamic slot access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126363. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...