Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-59727

Cross-Site Scripting (XSS) in astro (CVE-2026-59727)

Summary

Cross-site scripting in astro (CVE-2026-59727). Risk of unauthorized operations or information disclosure. Exploitable via attrs. Mitigation: upgrade to 7.0.4 or later.

Original description

The description as published by the source.

Summary

When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered `` element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).

Severity

Although a generic reflected XSS scores in the Medium range, exploitation here requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This mitigating precondition places the real-world severity at Low.

Details

In generateHydrateScript() (packages/astro/src/runtime/server/hydration.ts), every island property is HTML-escaped before serialization — the attrs, props, and opts assignments all pass through escapeHTML(). The transition directives, however, were copied verbatim:

transitionDirectivesToCopyOnIsland.forEach((name) => {
  if (typeof props[name] !== 'undefined') {
    island.props[name] = props[name]; // not escaped
  }
});

The `` element is serialized via renderElement('astro-island', island, false) with shouldEscape=false, and toAttributeString()…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-59727 has been found in astro.
Attackers can target a specific entry point like attrs over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade astro to 7.0.4 or later.
If unsure, ask your IT team or search "astro CVE-2026-59727" on the vendor's site.

CVE-2026-59727 (astro) — CWE-79
Attack surface: attrs / props / opts
Patched: 7.0.4 — apply immediately
Workaround: Do not pass untrusted or request-derived input into transition:persist, transition:scope, or transition:persist-props.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Cross-site scripting (XSS) (CWE-79) exists in astro. Attackers reach the vulnerable code path via attrs.

📍 Affected scope

Check the vendor advisory for the affected versions of astro. Attack surface: attrs / props / opts.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 7.0.4.

🛡️ Workaround

Workaround: Do not pass untrusted or request-derived input into transition:persist, transition:scope, or transition:persist-props.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'astro' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'astro' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で astro を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply temporary workaround mitigate 
    Do not pass untrusted or request-derived input into `transition:persist`, `transition:scope`, or `transition:persist-props`.

    パッチが適用されるまでの応急処置として、Do not pass untrusted or request-derived input into transition:persist, transition:scope, or transition:persist-props. を実施。回避策の副作用 (機能低下) を確認した上で。

  3. 3
    Apply patch patch 
    Upgrade astro to 7.0.4

    ステージング環境で 7.0.4 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  4. 4
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

npm astro
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details