CVE-2026-114128 in Astro
Summary
by MITRE • 10/21/2026
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes attacker-controlled data directly as a dynamic child can allow a value containing a closing script or style tag to terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escape dynamic strings automatically; the issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components. Successful exploitation can produce reflected or stored cross-site scripting under the application's origin. This issue is fixed in 7.3.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
Astro is a modern static site generator and web framework designed for building content-driven websites with efficient rendering pipelines. The vulnerability identified affects versions prior to 7.3.2, specifically within the JSX and MDX rendering mechanisms that handle script and style elements. In standard web development practices, dynamic content injected into HTML structures must be carefully sanitized or escaped to prevent injection attacks. However, in this specific implementation, Astro's renderer treats string children of script and style tags as trusted HTML without sufficiently distinguishing between compiler-generated literal content and values derived from dynamic expressions. This architectural oversight creates a critical security gap where the framework fails to apply necessary escaping mechanisms for data that originates from user-controlled sources within these specific DOM contexts.
The technical flaw arises when an application developer passes attacker-controlled data directly as a dynamic child element inside script or style tags rendered through the astro:jsx renderer, including MDX components. Because the framework assumes trust in string children of these elements, it does not escape special characters such as greater-than signs or quotation marks that are essential for breaking out of the current tag context. An attacker can exploit this by injecting a payload containing closing script or style tags followed by arbitrary HTML and JavaScript code. This allows the injected content to terminate the original element prematurely and execute new scripts within the page's execution environment, effectively bypassing standard browser security models like the same-origin policy in terms of initial injection vectors.
The operational impact of this vulnerability is significant, as it enables both reflected and stored cross-site scripting attacks under the application’s origin. Reflected XSS occurs when the malicious payload is immediately returned to the user via a response, while stored XSS involves persisting the payload on the server for later delivery to other users. Since the injection happens within script or style contexts, the resulting code execution can be particularly potent, potentially allowing attackers to steal session cookies, perform actions on behalf of authenticated users, deface websites, or redirect victims to malicious sites. The scope is limited to dynamic expressions in these specific rendering paths; other JSX expression contexts automatically escape dynamic strings, which mitigates risks in most common usage scenarios but leaves this narrow edge case exposed.
To mitigate this vulnerability, organizations must upgrade their Astro framework installations to version 7.3.2 or later, where the issue has been resolved by implementing stricter handling of dynamic content within script and style elements. Until an upgrade is feasible, developers should manually ensure that any data passed as children to these elements is rigorously sanitized using established HTML escaping libraries before rendering. It is also advisable to review codebases for instances where user input or external API responses are directly interpolated into JSX expressions inside script tags, replacing such patterns with safer alternatives like setting properties via JavaScript APIs rather than direct DOM manipulation through string interpolation. This vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting, and maps to the ATT&CK technique T1059.007 for Command and Scripting Interpretation via JavaScript within web applications.