Source summary

Summary Astro's JSX and MDX rendering pipeline treated string children of , an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escaped dynamic strings automatically. This behavior was limited to passed to was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script. The fix preserves raw rendering for literal script and style content while escaping dynamic string children like other JSX expression values. Impact Affected applications could be vul

Affected

astro <7.3.2

Fixed in

7.3.2

ID

GHSA-98hj-9722-w3j8

Source summary

Summary Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration , a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page. The injected content remains inside the generated element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes element. CSS delimiters such as ; , { , and } remained active, allowing a value

Affected

astro >=7.1.0 <=7.3.2

Fixed in

7.3.3

ID

GHSA-mpr7-6m5w-76rw