CVE-2026-59727 in astro
Summary
by MITRE • 07/27/2026
Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability exists within Astro web framework versions 3.10.0 through 7.0.3 where improper HTML escaping of directive values creates a reflected cross-site scripting (XSS) opportunity. The flaw specifically affects client-hydrated components that utilize transition:persist, transition:scope, or transition:persist-props directives, which are commonly used for managing component state during client-side hydration processes. When developers incorporate attacker-controlled input directly into these transition directives without proper sanitization, the framework fails to escape the directive values before rendering them into the <astro-island> element attributes.
The technical implementation of this vulnerability stems from Astro's handling of directive attributes within server-rendered output. During the rendering process, when a client-hydrated component contains one of these specific transition directives with dynamic values, the framework copies the directive content directly onto the rendered <astro-island> element without applying HTML escaping. This creates an injection point where malicious input can break out of the attribute context and inject arbitrary HTML or JavaScript code into the server-rendered page. The vulnerability represents a classic reflected XSS scenario where user-controllable data flows through the application's rendering pipeline and back to the client without proper sanitization.
The operational impact of this vulnerability is significant as it allows attackers to execute arbitrary JavaScript in the context of affected users' browsers, potentially leading to session hijacking, data theft, or further exploitation. The attack requires a non-idiomatic developer pattern where untrusted input is directly reflected into transition directives, making it less likely to occur in well-structured applications but still present in improperly secured codebases. The vulnerability affects any Astro application that uses these specific transition directives with dynamic content, particularly those that process user input through routing mechanisms and directly inject it into component attributes.
Mitigation strategies should focus on both immediate remediation and defensive programming practices. Applications must upgrade to Astro version 7.0.4 or later where the issue has been patched, ensuring proper HTML escaping of directive values during server-side rendering. Developers should avoid passing untrusted input directly into transition directives and implement proper input sanitization before any dynamic content is injected into component attributes. The fix aligns with CWE-79 (Cross-site Scripting) remediation principles and follows ATT&CK technique T1203 (Exploitation for Client Execution) by addressing the root cause of reflected JavaScript injection in web frameworks. Organizations should also implement security code reviews focusing on directive usage patterns and consider automated scanning tools to detect potentially vulnerable code patterns in their Astro applications.
This vulnerability demonstrates the importance of proper input validation and output escaping in modern web frameworks, particularly when dealing with dynamic component attributes that are rendered server-side. The issue highlights how seemingly minor implementation details in framework rendering can create significant security risks when combined with improper developer practices. Security teams should monitor for similar patterns across other frameworks and components where dynamic attribute values are not properly escaped during rendering processes, as this represents a common attack vector in modern web application architectures.