CVE-2026-59727
Severity CVSS v4.0:
LOW
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
27/07/2026
Last modified:
28/07/2026
Description
Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.
Impact
Base Score 4.0
2.10
Severity 4.0
LOW
References to Advisories, Solutions, and Tools
- https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294
- https://github.com/withastro/astro/pull/17212
- https://github.com/withastro/astro/releases/tag/astro@7.0.4
- https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2
- https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2