The Astro web framework (versions 2.9.0 through 7.0.x) has a CWE-79 cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the server-side View Transition CSS generator interpolates animation properties such as duration into inline style elements without escaping them for CSS and HTML contexts. This allows an attacker controlling these animation values to terminate the style element and inject arbitrary HTML or JavaScript. The vulnerable code is located in packages/astro/src/runtime/server/transition.ts, where renderTransition passes serialized animation properties into markHTMLString() without proper sanitization. Exploitation requires an on-demand or server-rendered route that passes attacker-controlled data into a View Transition animation definition. Successful exploitation enables arbitrary JavaScript execution in the application's origin, risking access to sensitive page data and authenticated user actions. The vulnerability is resolved in Astro version 7.1.0.

An attacker who can supply malicious input to a View Transition animation property in an affected Astro application can execute arbitrary JavaScript in the context of the application's origin. This can lead to theft of sensitive page data and unauthorized actions performed with the victim's privileges. The vulnerability requires user interaction (UI) and network access but no privileges or authentication. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the moderate impact and ease of exploitation.

This vulnerability is fixed in Astro version 7.1.0. Users should upgrade to version 7.1.0 or later to remediate the issue. There is no official patch or temporary fix available for earlier versions. Until upgrading, avoid passing untrusted input into View Transition animation properties in server-rendered or on-demand routes to reduce risk.