CVE-2026-73422 in Astro
Summary
by MITRE • 08/12/2026
Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition and can execute arbitrary JavaScript in the affected application's origin, allowing access to sensitive page data and authenticated actions available to the victim. This issue is fixed in version 7.1.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability identified in Astro web framework affects versions between 2.9.0 and 7.1.0, specifically within the server-side View Transition CSS generator functionality. This flaw resides in the packages/astro/src/runtime/server/transition.ts file where animation properties are interpolated into inline style elements without proper sanitization for CSS and HTML contexts. The vulnerability manifests when attacker-controlled data flows through the View Transition animation definition process, creating a path for cross-site scripting attacks that can execute arbitrary JavaScript code within the application's origin.
The technical implementation of this vulnerability stems from the renderTransition function which passes sheet.toString() directly into markHTMLString() without adequate escaping or sanitization. The addAnimationProperty method serializes duration through toTimeValue() while also handling easing, direction, delay, fillMode, and name parameters, creating multiple injection points within the CSS generation process. When an attacker controls any of these animation properties, particularly duration, they can manipulate the generated inline style elements to terminate them prematurely and inject malicious HTML or JavaScript code that will execute in the victim's browser context.
This vulnerability operates under the principle of insecure direct object reference and cross-site scripting exploitation patterns commonly found in web application frameworks. The attack requires a server-rendered route or on-demand rendering scenario where attacker-controlled data can flow into the View Transition animation definition, making it particularly dangerous in content-driven applications that accept user input for page transitions. The impact allows attackers to execute arbitrary JavaScript code within the same origin as the affected application, potentially accessing sensitive page data and performing authenticated actions on behalf of victims.
The operational implications of this vulnerability are significant for any Astro application using server-side rendering or on-demand routes with user-controllable View Transition animations. Attackers can leverage this flaw to perform session hijacking, data exfiltration, privilege escalation, and other malicious activities that exploit the application's trust relationship with authenticated users. The vulnerability aligns with CWE-79 (Cross-site Scripting) and CWE-116 (Improper Encoding or Escaping of Output) classifications, while also mapping to ATT&CK techniques such as T1059.001 (Command and Scripting Interpreter: Visual Basic) and T1531 (Account Access Removal) through potential privilege escalation vectors.
Mitigation strategies should focus on updating to version 7.1.0 or later where the vulnerability has been patched, implementing strict input validation for all View Transition animation parameters, and sanitizing any user-controllable data before it reaches the CSS generation pipeline. Organizations should also consider implementing Content Security Policy headers to limit script execution capabilities and monitor for unusual patterns in server-rendered content that might indicate exploitation attempts. The fix likely involves proper escaping of CSS and HTML special characters within the transition.ts file's serialization process, ensuring that attacker-controlled values cannot terminate inline style elements or inject malicious payloads into the generated output.