CVE-2026-59729 is a cross-site scripting vulnerability in the Astro web framework affecting versions before 7.0.6. The vulnerability stems from the renderHTMLElement function in packages/astro/src/runtime/server/render/dom.ts, which interpolates attribute names without escaping them, while only escaping attribute values. Although a previous fix for CVE-2026-54298 added a guard in addAttribute() to drop invalid attribute names, renderHTMLElement uses a separate attribute rendering path that was not updated. This allows untrusted spread property keys containing characters like ' >/= or whitespace to inject malicious scripts. The issue is resolved in Astro version 7.0.6.

An attacker can exploit this vulnerability by supplying untrusted property keys that get spread onto native HTMLElement components, enabling cross-site scripting attacks. This can lead to the execution of arbitrary scripts in the context of the affected web application, potentially compromising user data or session integrity. The CVSS 4.0 base score is 5.1 (medium severity), indicating a moderate risk with network attack vector, no privileges required, and user interaction needed.

This vulnerability is fixed in Astro version 7.0.6. Users should upgrade to version 7.0.6 or later to remediate this issue. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated in the vendor advisory fields, but the fix is confirmed in version 7.0.6.