Astro: Arbitrary CSS injection in Astro View Transitions.
Does it affect you?
Not read yetConditions are read within the hour after an advisory comes in.
Summary Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration , a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page. The injected content remains inside the generated element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes element. CSS delimiters such as ; , { , and } remained active, allowing a value
Timeline
12 Oct- Published by GitHub advisory12 Oct
- Seen by Patchwire23 Oct
- Fix released12 Oct
Versions of astro
Related alerts(1)
Same packagesSource summary
Summary Astro's JSX and MDX rendering pipeline treated string children of , an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escaped dynamic strings automatically. This behavior was limited to passed to was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script. The fix preserves raw rendering for literal script and style content while escaping dynamic string children like other JSX expression values. Impact Affected applications could be vul
- Affected
- astro <7.3.2
- Fixed in
- 7.3.2
- ID
- GHSA-98hj-9722-w3j8