The vulnerability in Astro (versions 3.10.0 through 7.0.3) involves improper neutralization of input during web page generation (CWE-79). When the transition:persist, transition:scope, or transition:persist-props directives are applied to client-hydrated components, Astro copies the directive values onto the <astro-island> element without HTML-escaping. If a developer passes untrusted, attacker-controlled input into these directives, it can lead to reflected XSS by breaking out of the attribute context and injecting arbitrary HTML/JavaScript into server-rendered output. This requires a non-idiomatic developer pattern and is not exploitable if untrusted input is not routed into these directives. The vulnerability is resolved in Astro version 7.0.4.

Successful exploitation allows an attacker to inject arbitrary HTML or JavaScript into the server-rendered output, leading to reflected cross-site scripting (XSS). This can result in execution of malicious scripts in the context of the victim's browser. However, exploitation requires that the developer explicitly passes untrusted input into the vulnerable directives, which is not typical. The CVSS 4.0 score is low (2.1), reflecting the limited attack vector and required conditions.

This vulnerability is fixed in Astro version 7.0.4. Users should upgrade to version 7.0.4 or later to remediate the issue. Applications that do not pass untrusted input into the affected transition directives are not vulnerable. No other vendor advisory or patch information is available; therefore, patch status is confirmed by the fixed version 7.0.4. No additional mitigation steps are indicated.