CVE-2026-50146 is a reflected XSS vulnerability in the Astro web framework before version 6.3.3. When a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name. This improper neutralization of script-related HTML tags (CWE-80) enables an attacker to break out of the attribute context and inject arbitrary HTML during SSR, leading to reflected cross-site scripting. The issue is resolved in Astro 6.3.3.

An attacker can exploit this vulnerability to inject arbitrary HTML into web pages rendered by Astro during SSR, potentially leading to the execution of malicious scripts in the context of the victim's browser. This can result in information disclosure or other impacts associated with reflected XSS. The CVSS 3.1 base score is 7.1 (High), reflecting the network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact.

Upgrade to Astro version 6.3.3 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating the fix is in 6.3.3.