CVE-2026-59727: astro >= 3.10.0, < 7.0.4

Affected technology

astro · >= 3.10.0, < 7.0.4
withastro

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

The source says if a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Vendor/CNA’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality, integrity and availability impact as none.