A reflected cross-site scripting (XSS) vulnerability exists in the @astrojs/svelte renderer where slot names are not HTML-escaped before being inserted into the name attribute of an <astro-slot> element. This allows an attacker to inject arbitrary HTML and JavaScript if a slot name is derived from untrusted input such as a URL query parameter. The vulnerability affects versions from 5.7.3 up to 9.1.1 and is fixed in version 9.1.2.