A reflected cross-site scripting (XSS) vulnerability exists in Astro versions prior to 5.15.8 when using the server islands feature. This flaw allows an attacker to inject malicious HTML/JavaScript code via the 's' parameter in requests to the /_server-islands/[name] endpoint, regardless of the component template used. The vulnerability arises because the 'file' value of the 'e' parameter returns the absolute path of the island file, which is sanitized and used as a tag name, while the slot content from 's' is injected as a child, enabling XSS payload execution. A fix is available in version 5.15.8.