Threats tagged 'ghsa-mh32-jxcr-mh9f'

Astro versions up to 7.4.4 have a reflected or stored cross-site scripting (XSS) vulnerability via attribute injection in dynamic tag names. When a dynamic tag resolves to a string containing a slash (/), Astro's filtering failed to prevent injection of attributes, allowing crafted tag names like 'img/src/onerror=alert(1)' to render as elements with malicious attributes. This affects applications that use untrusted input directly as element names. The issue is fixed in Astro 7.4.5, which properly restricts dynamic tag names to valid element names and throws errors for invalid ones.