CVE-2026-73422: Astro Web Framework XSS Vulnerability

CVE-2026-73422 Overview

CVE-2026-73422 is a Cross-Site Scripting (XSS) vulnerability in Astro, a web framework for content-driven websites. The flaw affects versions 2.9.0 through 7.1.0 and resides in the server-side View Transition CSS generator. Astro interpolates animation properties into an inline <style> element without escaping them for CSS and HTML contexts. An attacker who controls a View Transition animation value can terminate the generated style element and inject arbitrary HTML or JavaScript. Execution occurs in the affected application's origin, exposing sensitive page data and authenticated actions available to the victim. The issue is tracked as [CWE-79] and fixed in Astro version 7.1.0.

Critical Impact
Attackers can execute arbitrary JavaScript in the victim's browser context, enabling session theft, data exfiltration, and unauthorized actions on behalf of authenticated users.

Affected Products

Astro framework versions 2.9.0 through 7.0.x
Applications using on-demand or server-rendered routes that pass attacker-controlled data into View Transition animation definitions
Server-side rendered Astro sites relying on the renderTransition code path

Discovery Timeline

2026-08-12 - CVE-2026-73422 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73422

Vulnerability Analysis

The vulnerability resides in packages/astro/src/runtime/server/transition.ts. The renderTransition function passes sheet.toString() into markHTMLString(), marking the output as trusted HTML without additional escaping. Inside the sheet generation, addAnimationProperty serializes user-supplied values for duration, easing, direction, delay, fillMode, and name. Because toTimeValue() and related serializers do not escape characters meaningful to CSS or HTML, attacker-supplied strings flow directly into the emitted inline <style> element.

Exploitation requires an on-demand or server-rendered route to accept attacker-controlled data and forward it into a View Transition animation definition. A crafted duration value can close the <style> tag and introduce arbitrary markup, including <script> blocks that execute in the application's origin.

Root Cause

The root cause is missing contextual output encoding [CWE-79]. Animation properties are concatenated into an HTML-embedded stylesheet and then wrapped with markHTMLString(), which signals the renderer to skip escaping. Neither CSS-context nor HTML-context escaping is applied to the interpolated values.

Attack Vector

An attacker submits crafted input to any server-rendered endpoint that binds request data to a View Transition animation. When Astro renders the page, the injected payload breaks out of the inline <style> element and executes JavaScript in the victim's session, granting access to cookies, authenticated APIs, and DOM data.

typescript

// Security patch: packages/astro/src/runtime/server/escape.ts
// Adds CSS-context escaping used by the fix in PR #17393
	return JSON.stringify(value)?.replace(/</g, '\\\u003c');
 }

+/** Escapes CSS text so it can be embedded inside a `<style>` tag. */
+export function escapeStyleText(value: string): string {
+	return value.replaceAll('<', '\\3C ');
+}
+
 export class HTMLBytes extends Uint8Array {}
// Source: https://github.com/withastro/astro/commit/092da560eea77ee63a3e2c583c80d8238544e42b

The patch introduces escapeStyleText, which replaces < characters with the CSS escape sequence \3C . This prevents attackers from closing the surrounding <style> element with strings such as </style><script>.

Detection Methods for CVE-2026-73422

Indicators of Compromise

Server access logs containing request parameters with </style>, <script, or CSS-terminating sequences targeting routes that render View Transitions
Rendered HTML responses containing unexpected <script> tags inside or immediately following inline <style> blocks emitted by Astro
Content Security Policy (CSP) violation reports referencing inline script execution on Astro-rendered pages
Outbound requests from user browsers to attacker-controlled domains sourced from pages using View Transitions

Detection Strategies

Perform static analysis of Astro projects to locate transition:animate, ViewTransition, or renderTransition usage that binds to request-derived data such as query strings, form input, or path parameters
Enable and monitor CSP report-uri or report-to endpoints to catch inline script injection attempts
Inspect server-rendered HTML in staging environments for stylesheet output that reflects untrusted input verbatim

Monitoring Recommendations

Alert on anomalous query parameters and POST bodies containing HTML or CSS control characters directed at Astro routes
Track deployed Astro versions across the software supply chain and flag any instance below 7.1.0
Correlate web application firewall (WAF) XSS signature hits with responses served by Astro origins

How to Mitigate CVE-2026-73422

Immediate Actions Required

Upgrade Astro to version 7.1.0 or later, which introduces escapeStyleText and contextual escaping for rendered content
Audit all server-rendered routes for View Transition animation values sourced from user input and remove or sanitize those bindings until the upgrade is complete
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources to reduce exploitability

Patch Information

The fix is included in Astro 7.1.0 and delivered through pull request #17393. Details are available in the GitHub Security Advisory GHSA-4g3v-8h47-v7g6, the GitHub Commit Details, and the GitHub Release 7.1.0 notes.

Workarounds

Avoid passing request-derived data into View Transition properties such as duration, easing, direction, delay, fillMode, or name
Validate and allowlist animation values against a fixed set of safe tokens before rendering
Disable View Transitions on routes that must accept untrusted input until patching completes

bash

# Upgrade Astro to the patched release
npm install astro@^7.1.0

# Verify the installed version
npx astro --version