CVE-2026-114128: Astro Framework XSS Vulnerability

CVE-2026-114128 Overview

Astro is a web framework for content-driven websites. CVE-2026-114128 is a cross-site scripting (XSS) vulnerability [CWE-79] affecting Astro versions prior to 7.3.2. The astro:jsx renderer treats string children of <script> and <style> elements as trusted HTML, failing to distinguish compiler-generated literal content from dynamic expression values. An attacker who controls data passed as a dynamic child of these elements can inject a closing </script> or </style> tag to terminate the element and execute arbitrary HTML and JavaScript under the application's origin. The flaw is fixed in Astro 7.3.2.

Critical Impact

Attacker-controlled strings rendered inside <script> or <style> children through the astro:jsx renderer, including MDX components, enable reflected or stored XSS in the application's origin.

Affected Products

• Astro web framework versions prior to 7.3.2
• MDX components rendered through the astro:jsx renderer
• Applications using JSX <script> or <style> elements with dynamic children

Discovery Timeline

• 2026-10-21 - CVE CVE-2026-114128 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114128

Vulnerability Analysis

Astro's JSX runtime renders JSX children as HTML during server-side rendering. For most JSX expression contexts, dynamic string values are automatically HTML-escaped. The <script> and <style> elements are special: their content is defined as raw text in HTML, so the renderer passed string children through without escaping. The renderer did not differentiate between literal template content produced by the compiler and runtime values originating from component props, loaders, or MDX frontmatter.

When an attacker-controlled string reaches a <script> or <style> child, a payload containing </script> or </style> closes the element early. Everything that follows is parsed as new HTML in the document, enabling arbitrary markup and script execution. Successful exploitation produces reflected or stored XSS executed within the application's origin, which can be used to steal session cookies, perform actions on behalf of users, or stage further client-side attacks.

Root Cause

The astro:jsx renderer in packages/astro/src/runtime/server/jsx.ts and the streaming renderer in packages/astro/src/runtime/server/render/streaming.ts marked all string children of <script> and <style> as raw HTML. There was no provenance tracking to separate compiler-generated literal children from values supplied by runtime expressions.

Attack Vector

Exploitation requires user interaction (UI:R) and no privileges. An attacker supplies a payload that becomes a dynamic child of a <script> or <style> element in a page rendered by the astro:jsx renderer or an MDX component. When the victim loads the page, the payload breaks out of the element and executes.

// Patch excerpt: packages/astro/src/runtime/server/jsx.ts
 import { AstroJSX, type AstroVNode, isVNode } from '../../jsx-runtime/index.js';
 import type { SSRResult } from '../../types/public/internal.js';
+import { escapeStyleText } from './escape.js';
 import {
 	escapeHTML,
 	HTMLString,
// Source: https://github.com/withastro/astro/commit/a548223607b9bb146d5d90ddda495343f9a2a739

// Patch excerpt: packages/astro/src/runtime/server/render/streaming.ts
 import type { SSRResult } from '../../../types/public/internal.js';
 import type { AstroVNode } from '../../../jsx-runtime/index.js';
 import { isVNode } from '../../../jsx-runtime/index.js';
-import { escapeHTML, HTMLString, isHTMLString, markHTMLString } from '../escape.js';
+import {
+	escapeHTML,
+	escapeStyleText,
+	HTMLString,
+	isHTMLString,
+	markHTMLString,
+} from '../escape.js';
 import { spreadAttributes } from '../index.js';
 import { isPromise } from '../util.js';
 import { renderJSX } from '../jsx.js';
// Source: https://github.com/withastro/astro/commit/a548223607b9bb146d5d90ddda495343f9a2a739

The patch adds an escapeStyleText helper and restricts raw-text treatment to literal, compiler-generated children. Dynamic string children of <script> and <style> are now escaped before rendering.

Detection Methods for CVE-2026-114128

Indicators of Compromise

• Unexpected </script> or </style> substrings appearing in HTTP response bodies served by Astro applications.
• Server-rendered pages containing inline script content sourced from request parameters, CMS fields, or MDX frontmatter.
• Browser Content Security Policy (CSP) violation reports referencing unexpected inline scripts on Astro-rendered pages.

Detection Strategies

• Audit Astro codebases for JSX or MDX components rendering <script> or <style> elements whose children are expressions rather than literal strings.
• Grep for patterns such as <script>{...}</script> and <style>{...}</style> in .jsx, .tsx, .mdx, and .astro files.
• Run dependency scanners against package.json to flag astro versions below 7.3.2.

Monitoring Recommendations

• Enable CSP with script-src directives that disallow unsafe inline scripts and monitor violation reports.
• Log and alert on web application firewall (WAF) events matching encoded </script> or </style> payloads in request parameters.
• Review stored content fields rendered through MDX for payloads containing closing script or style tags.

How to Mitigate CVE-2026-114128

Immediate Actions Required

• Upgrade Astro to version 7.3.2 or later across all projects and rebuild deployed artifacts.
• Inventory applications that use the astro:jsx renderer or MDX components with inline <script> or <style> elements.
• Rotate any session tokens or secrets that could have been exposed through client-side script execution on affected pages.

Patch Information

The fix is included in Astro 7.3.2. The relevant changes are in commit a548223 and were introduced in pull request #17896. Full details are available in the GitHub Security Advisory GHSA-98hj-9722-w3j8 and the Astro 7.3.2 release notes.

Workarounds

• Avoid passing dynamic, user-controlled values as children of <script> or <style> elements in JSX and MDX.
• Pre-sanitize untrusted strings to strip </script> and </style> sequences before rendering if upgrade is delayed.
• Deploy a strict CSP that forbids inline scripts to reduce the impact of injection in server-rendered pages.

# Upgrade Astro to the fixed release
npm install astro@7.3.2
# or
pnpm add astro@7.3.2
# or
yarn add astro@7.3.2

# Verify installed version
npm ls astro