CVE-2026-59729
Received Received - Intake

XSS in Astro Framework via Unescaped Spread Attributes

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-59729
EUVD
EUVD-2026-49580

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
astro astro 7.0.6
withastro astro 7.0.6
withastro astro to 7.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59729 is a Cross-Site Scripting (XSS) vulnerability in the Astro framework affecting versions 7.0.3 and below. It occurs because unescaped spread attribute names in custom element rendering allow untrusted property keys to break out of the attribute context. The function renderHTMLElement() interpolates attribute names without escaping them, only escaping values. This enables attackers to inject malicious event-handler attributes or script tags into the SSR output.

Detection Guidance

To detect this vulnerability, check if your Astro version is below 7.0.6. Run commands like 'npm list astro' or 'astro --version' to verify the installed version. If vulnerable, update immediately to 7.0.6 or later.

Impact Analysis

If you use Astro versions prior to 7.0.6, an attacker could exploit this to inject malicious scripts or event handlers into your web pages. This could lead to data theft, session hijacking, or defacement of your site. The attack requires an attacker to control the keys of an object spread onto a component extending HTMLElement in an SSR environment.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or manipulation, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. A successful exploit may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Upgrade Astro to version 7.0.6 or later using 'npm update astro' or by specifying the version in your package.json. No additional configuration is required as the fix is internal.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59729. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart