CVE-2026-59727: Astro Web Framework XSS Vulnerability

CVE-2026-59727 Overview

CVE-2026-59727 is a reflected cross-site scripting (XSS) vulnerability in Astro, a web framework for content-driven websites. Versions 3.10.0 through 7.0.3 fail to HTML-escape the value of transition:persist, transition:scope, and transition:persist-props directives when they are applied to client-hydrated (client:*) components. The framework copies the raw directive value onto the rendered <astro-island> element. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML or JavaScript. The issue is fixed in version 7.0.4 and tracked as [CWE-79].

Critical Impact
Reflected XSS enabling attacker-controlled HTML/JavaScript execution in the victim's browser when untrusted input is passed into an Astro transition directive.

Affected Products

Astro framework versions 3.10.0 through 7.0.3
Applications using client:* hydrated components with transition:persist, transition:scope, or transition:persist-props directives
Astro applications that route request-derived input into transition directives

Discovery Timeline

2026-07-27 - CVE-2026-59727 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-59727

Vulnerability Analysis

The flaw resides in Astro's server-side hydration renderer. When a component uses client:* hydration together with a transition directive, the framework serializes the directive value into an attribute on the rendered <astro-island> custom element. The value is written into the HTML output without escaping the characters <, >, ", ', or &.

Because the attribute is emitted verbatim, a value containing a closing quote followed by additional attributes or a <script> tag can escape the intended attribute boundary. The injected markup is then parsed by the browser as part of the DOM, producing reflected XSS.

Exploitation requires a non-idiomatic pattern in application code. The developer must pass untrusted, request-derived input directly into a transition directive. Applications that only pass static or server-controlled values into these directives are not affected.

Root Cause

The root cause is missing output encoding in the transitionDirectivesToCopyOnIsland handler within packages/astro/src/runtime/server/hydration.ts. Directive values were assigned to island.props[name] and later serialized into HTML attributes without passing through escapeHTML. Any character with special meaning in HTML attribute context could terminate the attribute early.

Attack Vector

An attacker crafts a URL or request payload that carries an XSS payload in a parameter the application reflects into a transition directive. When the victim loads the server-rendered page, the payload is emitted directly inside the <astro-island> attribute, breaks out, and executes in the victim's session. User interaction is required to trigger the vulnerable request.

typescript

// Patch from packages/astro/src/runtime/server/hydration.ts
transitionDirectivesToCopyOnIsland.forEach((name) => {
  if (typeof props[name] !== 'undefined') {
-    island.props[name] = props[name];
+    island.props[name] = escapeHTML(String(props[name]));
  }
});

The fix wraps every directive value in escapeHTML(String(...)) before assignment, ensuring characters that would otherwise terminate the HTML attribute are safely encoded. Source: GitHub Commit 7ba0bb1.

Detection Methods for CVE-2026-59727

Indicators of Compromise

Server-rendered HTML containing <astro-island> elements with unescaped <, >, or quote characters inside transition:persist, transition:scope, or transition:persist-props attributes
Web server access logs showing request parameters containing HTML metacharacters or <script> payloads directed at routes that render Astro islands
Content Security Policy violation reports referencing inline script execution on Astro-rendered pages

Detection Strategies

Perform a source code audit for any pattern that passes Astro.request, Astro.url.searchParams, Astro.params, or cookie values into a transition:* directive on a client:* component.
Add regression tests that render pages with malicious parameter values and assert that the resulting HTML contains only encoded entities in transition attributes.
Run dynamic application security testing (DAST) against Astro routes with payloads such as " onmouseover=alert(1) x=" targeting query parameters that flow into components.

Monitoring Recommendations

Alert on Web Application Firewall (WAF) rules that detect HTML injection payloads in query strings on Astro-served endpoints.
Monitor CSP report-uri endpoints for a rise in script-src violations originating from server-rendered pages.
Track the deployed Astro version across build pipelines and alert on any deployment still using a version between 3.10.0 and 7.0.3.

How to Mitigate CVE-2026-59727

Immediate Actions Required

Upgrade Astro to version 7.0.4 or later across all environments.
Review the codebase for any use of transition:persist, transition:scope, or transition:persist-props on client:* components and confirm no untrusted input reaches these directives.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of any residual injection.

Patch Information

The vulnerability is fixed in Astro 7.0.4. The patch adds escapeHTML(String(props[name])) to every directive value copied onto the <astro-island> element. See the GitHub Security Advisory GHSA-7pw4-f3q4-r2p2, the GitHub Pull Request #17212, and the GitHub Release 7.0.4.

Workarounds

Refactor components so that transition directive values are static or derived only from server-controlled data, not from request input.
Sanitize and HTML-escape any dynamic value before passing it to a transition directive if an immediate upgrade is not possible.
Deploy a WAF rule that blocks HTML metacharacters in query parameters known to feed Astro components until the upgrade is complete.

bash

# Upgrade Astro to the patched release
npm install astro@7.0.4

# Verify the installed version
npx astro --version