Astro versions before 6.1.6 contain an XSS vulnerability due to the defineScriptVars function's use of a case-sensitive regular expression /<\/script>/g for sanitizing injected values in inline <script> tags. HTML parsers close <script> elements case-insensitively and accept variations such as </Script>, </script >, or </script/>, which the regex does not catch. This allows attackers to bypass sanitization and inject arbitrary HTML or JavaScript code. The vulnerability is addressed in Astro version 6.1.6.

Successful exploitation allows an attacker to inject arbitrary HTML or JavaScript into web pages rendered by vulnerable versions of Astro, potentially leading to cross-site scripting attacks. This can result in limited confidentiality and integrity impacts, such as theft of user data or session tokens, but does not affect availability. There are no known exploits in the wild at this time.

A fix is available in Astro version 6.1.6. Users and administrators should upgrade to version 6.1.6 or later to remediate this vulnerability. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor advisory indicating the issue is fixed in 6.1.6.