CVE-2026-59727
Received Received - Intake

Astro Framework Reflected XSS via Transition Directives

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-59727
EUVD
EUVD-2026-49581

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
astro astro From 3.10.0 (inc) to 7.0.3 (inc)
astro astro 7.0.4
withastro astro From 3.10.0 (inc) to 7.0.3 (inc)
withastro astro 7.0.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-83 The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59727 is a reflected cross-site scripting (XSS) vulnerability in the Astro framework affecting versions 3.10.0 through 7.0.3. The issue occurs when untrusted input is reflected into transition:persist, transition:scope, or transition:persist-props directives on client-hydrated components. Astro fails to HTML-escape these directive values when rendering them onto the <astro-island> element, allowing attackers to inject arbitrary HTML or JavaScript.

Detection Guidance

To detect this vulnerability, inspect Astro applications using versions 3.10.0 through 7.0.3 for improperly escaped transition directives. Check for untrusted input reflected in transition:persist, transition:scope, or transition:persist-props attributes. Use automated tools like ESLint plugins for Astro or manual code review to identify such patterns.

Impact Analysis

If exploited, this vulnerability could allow attackers to inject malicious scripts into web pages viewed by users. This could lead to theft of sensitive data, session hijacking, or defacement of the website. Exploitation requires developers to pass untrusted input directly into these directives, which is not standard practice.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected Astro versions may face compliance risks if exploited.

Mitigation Strategies

Upgrade Astro to version 7.0.4 or later to apply the fix that properly escapes transition directive values and prevents XSS attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59727. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart