CVE-2026-73422

Received Received - Intake

View Transition CSS Injection in Astro Framework

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition and can execute arbitrary JavaScript in the affected application's origin, allowing access to sensitive page data and authenticated actions available to the victim. This issue is fixed in version 7.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73422

Affected Vendors & Products

Vendor	Product	Version / Range
astro	astro	7.1.0
astro	astro	From 2.9.0 (inc) to 7.1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Astro versions 2.9.0 to 7.1.0 have a flaw in the server-side View Transition CSS generator. It incorrectly handles animation properties like duration, easing, and delay by inserting them into an inline style element without proper escaping. This allows attackers to inject arbitrary HTML or JavaScript by manipulating these values.

Detection Guidance

This vulnerability can be detected by checking the Astro framework version in use. If your system runs Astro versions between 2.9.0 and 7.1.0, it is potentially vulnerable. Inspect package.json or run commands like 'npm list astro' or 'yarn list astro' to verify the installed version.

Impact Analysis

If exploited, this vulnerability enables attackers to execute arbitrary JavaScript in the affected application's origin. This could lead to theft of sensitive page data, unauthorized actions on behalf of the victim, or complete compromise of the application and user sessions.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive data. Such breaches may violate GDPR, HIPAA, or other regulations, potentially resulting in legal penalties, fines, and reputational damage due to unauthorized data access or disclosure.

Mitigation Strategies

Upgrade Astro to version 7.1.0 or later immediately. This version contains the fix for the vulnerability. If upgrading is not immediately possible, disable View Transitions in your Astro configuration until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-73422. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70