CVE-2026-59729: Astro Web Framework XSS Vulnerability

CVE-2026-59729 Overview

CVE-2026-59729 is a cross-site scripting (XSS) vulnerability in Astro, a web framework for content-driven websites. Versions prior to 7.0.6 fail to validate spread-prop attribute names inside renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts. Untrusted prop keys spread onto a native-HTMLElement-subclass component can break out of the attribute context and inject markup. The issue is a regression of the fix for CVE-2026-54298, which only patched addAttribute() and missed a parallel attribute-rendering path. Astro has released version 7.0.6 to close the gap.

Critical Impact
Attackers who control prop keys spread onto custom HTML element components can inject arbitrary HTML attributes and script content during server-side rendering, leading to stored or reflected XSS [CWE-79].

Affected Products

Astro framework versions prior to 7.0.6
Applications using server-side rendering (SSR) with native HTMLElement subclass components
Astro projects that spread untrusted objects as props onto custom element components

Discovery Timeline

2026-07-27 - CVE-2026-59729 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-59729

Vulnerability Analysis

Astro renders custom HTML elements through a dedicated code path in renderHTMLElement(). This function iterates over component props and interpolates each attribute name directly into the output HTML. The value is HTML-escaped, but the attribute name is not.

When developers use JSX spread syntax to forward an untrusted object of props to a custom element component, an attacker who controls a key in that object can inject characters such as >, ", ', /, =, or whitespace. These characters terminate the attribute context and allow arbitrary attribute or tag injection, including event handlers such as onerror or onclick.

Root Cause

The fix for the earlier CVE-2026-54298 introduced an INVALID_ATTR_NAME_CHAR regex guard inside addAttribute() to strip attribute names containing forbidden characters. However, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts maintains its own inline attribute loop and never calls addAttribute(). The guard was not applied there, leaving the native-element rendering path exposed to the same class of attribute-name injection.

Attack Vector

Exploitation requires user interaction and network reachability to the SSR endpoint. An attacker submits data that eventually flows into a spread expression on a native HTMLElement-subclass component. The malicious key is emitted verbatim into the HTML output, breaking out of the attribute context and executing script in the victim's browser.

typescript

// Security patch applied in packages/astro/src/runtime/server/render/dom.ts
 import type { SSRResult } from '../../../types/public/internal.js';
 import { markHTMLString } from '../escape.js';
 import { renderSlotToString } from './slot.js';
-import { toAttributeString } from './util.js';
+import { INVALID_ATTR_NAME_CHAR, toAttributeString } from './util.js';
 
 export function componentIsHTMLElement(Component: unknown) {
 	return typeof HTMLElement !== 'undefined' && HTMLElement.isPrototypeOf(Component as object);

// Source: https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d

The companion change in packages/astro/src/runtime/server/render/util.ts exports the shared regex so both rendering paths enforce the same rule:

typescript

 const STATIC_DIRECTIVES = new Set(['set:html', 'set:text']);
 
 // Per the HTML spec, attribute names must not contain ASCII whitespace, ", ', >, /, or =.
-const INVALID_ATTR_NAME_CHAR = /[\s"'>/=]/;
+export const INVALID_ATTR_NAME_CHAR = /[\s"'>/=]/;

// Source: https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d

Detection Methods for CVE-2026-59729

Indicators of Compromise

Server-rendered HTML containing attribute names with characters ", ', >, /, =, or whitespace embedded inside a tag
Unexpected inline event handlers (onerror, onload, onclick) in responses generated by Astro SSR endpoints
Requests to Astro routes with unusual query or body parameters whose keys contain HTML metacharacters

Detection Strategies

Audit Astro component source for JSX spread expressions applied to custom elements that extend HTMLElement, and trace prop origins to determine if user input can reach them
Compare deployed Astro versions against 7.0.6 across build artifacts and package.json lockfiles
Run static analysis or grep for ...props patterns on components identified by componentIsHTMLElement

Monitoring Recommendations

Log and alert on outbound HTTP responses containing malformed attribute constructs from SSR endpoints
Enable web application firewall (WAF) rules that flag request parameters with keys containing <, >, ", ', or =
Track Content Security Policy (CSP) violation reports for inline script executions on pages rendered by Astro

How to Mitigate CVE-2026-59729

Immediate Actions Required

Upgrade Astro to version 7.0.6 or later across all applications and rebuild deployed artifacts
Review all components that extend HTMLElement and audit spread props for untrusted input
Deploy or tighten a Content Security Policy that blocks inline event handlers and inline scripts

Patch Information

The fix ships in Astro 7.0.6. The patch, tracked in Astro Pull Request #17251 and commit 5240e26, exports the INVALID_ATTR_NAME_CHAR regex from util.ts and applies it inside renderHTMLElement() so invalid attribute names are dropped before emission. Full details are in the Astro GitHub Security Advisory GHSA-f48w-9m4c-m7f5 and the Astro 7.0.6 release notes.

Workarounds

Avoid passing untrusted objects via spread syntax to components that extend HTMLElement; explicitly whitelist allowed prop names before rendering
Validate and sanitize object keys on the server before they enter the component tree, rejecting keys matching /[\s"'>/=]/
Replace custom-element components with standard Astro components until the upgrade is deployed

bash

# Upgrade Astro to the patched release
npm install astro@7.0.6

# Verify the installed version
npm ls astro