CVE-2026-114128: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in withastro astro

Astro is a web framework for content-driven websites. Versions before 7.3.2 have a vulnerability in the JSX and MDX rendering pipeline where string children of script and style elements are treated as trusted HTML. This lack of proper neutralization allows an attacker to inject arbitrary HTML and JavaScript if attacker-controlled data is passed directly as a dynamic child, enabling reflected or stored cross-site scripting (CWE-79). The issue is specific to script and style children rendered through the astro:jsx renderer and does not affect other JSX expression contexts which escape dynamic strings automatically. The vulnerability is resolved in version 7.3.2.

Successful exploitation can lead to reflected or stored cross-site scripting attacks under the application's origin, allowing an attacker to execute arbitrary JavaScript in the context of the vulnerable website. This can lead to impacts such as session hijacking, defacement, or other client-side attacks. The CVSS v3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

Upgrade to Astro version 7.3.2 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.