CVE-2026-114127: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in withastro astro

Astro versions 7.1.0 to 7.3.2 contain a CWE-79 vulnerability in the server-side View Transition CSS generator. The flaw occurs because string animation properties such as duration, delay, easing, direction, fillMode, or animation names are not properly sanitized before inclusion in CSS declarations. Attackers who can supply data to these properties may inject additional CSS rules by terminating the original declaration with CSS delimiters. The vulnerability does not allow injection of HTML or JavaScript since literal less-than characters are escaped, but the injected CSS can manipulate the page layout, conceal or reposition content, add generated text, or indirectly expose data through conditional resource loads. The issue is resolved in Astro 7.3.3.

The vulnerability allows attackers to inject arbitrary CSS into server-rendered pages, which can misrepresent the user interface by hiding or repositioning content and adding generated text. It may also lead to indirect exposure of data present in selectable DOM attributes via conditional resource loading. However, it does not permit direct injection of HTML or JavaScript, limiting the scope of potential exploitation. The CVSS 4.0 score is 2.3, indicating low severity.

This vulnerability is fixed in Astro version 7.3.3. Users should upgrade to version 7.3.3 or later to remediate the issue. No other specific mitigations are indicated by the vendor advisory.