Vulnerability-Lookup

CVE-2026-59727 (GCVE-0-2026-59727)

Vulnerability from cvelistv5 – Published: 2026-07-27 19:42 – Updated: 2026-07-27 19:42

Title

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Summary

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-83 - Improper Neutralization of Script in Attributes in a Web Page
CWE-116 - Improper Encoding or Escaping of Output

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/withastro/astro/security/advis…	x_refsource_CONFIRM
https://github.com/withastro/astro/pull/17212	x_refsource_MISC
https://github.com/withastro/astro/commit/7ba0bb1…	x_refsource_MISC
https://github.com/withastro/astro/releases/tag/a…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
withastro	astro	Affected: >= 3.10.0, < 7.0.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "astro",
          "vendor": "withastro",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.10.0, \u003c 7.0.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered \u003castro-island\u003e element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern \u2014 passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-83",
              "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T19:42:32.222Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2"
        },
        {
          "name": "https://github.com/withastro/astro/pull/17212",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/pull/17212"
        },
        {
          "name": "https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294"
        },
        {
          "name": "https://github.com/withastro/astro/releases/tag/astro@7.0.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/releases/tag/astro@7.0.4"
        }
      ],
      "source": {
        "advisory": "GHSA-7pw4-f3q4-r2p2",
        "discovery": "UNKNOWN"
      },
      "title": "Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59727",
    "datePublished": "2026-07-27T19:42:32.222Z",
    "dateReserved": "2026-07-06T15:34:16.917Z",
    "dateUpdated": "2026-07-27T19:42:32.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59727",
      "date": "2026-07-28",
      "epss": "0.0031",
      "percentile": "0.23311"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-59727\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-27T20:16:40.153\",\"lastModified\":\"2026-07-27T20:16:40.153\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered \u003castro-island\u003e element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern \u2014 passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"withastro\",\"product\":\"astro\",\"versions\":[{\"version\":\"\u003e= 3.10.0, \u003c 7.0.4\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"},{\"lang\":\"en\",\"value\":\"CWE-83\"},{\"lang\":\"en\",\"value\":\"CWE-116\"}]}],\"references\":[{\"url\":\"https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/withastro/astro/pull/17212\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/withastro/astro/releases/tag/astro@7.0.4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

GHSA-7PW4-F3Q4-R2P2

Vulnerability from github – Published: 2026-07-20 23:21 – Updated: 2026-07-20 23:21

Summary

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Details

Summary

When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).

Severity

Although a generic reflected XSS scores in the Medium range, exploitation here requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This mitigating precondition places the real-world severity at Low.

Details

In generateHydrateScript() (packages/astro/src/runtime/server/hydration.ts), every island property is HTML-escaped before serialization — the attrs, props, and opts assignments all pass through escapeHTML(). The transition directives, however, were copied verbatim:

transitionDirectivesToCopyOnIsland.forEach((name) => {
  if (typeof props[name] !== 'undefined') {
    island.props[name] = props[name]; // not escaped
  }
});

The <astro-island> element is serialized via renderElement('astro-island', island, false) with shouldEscape=false, and toAttributeString() returns the value unchanged in that mode. As a result there is no downstream re-escaping, and the raw directive value reaches the HTML response. This is the same output sink previously addressed for slot names in GHSA-8hv8-536x-4wqp.

The affected directives are:

data-astro-transition-scope (transition:scope)
data-astro-transition-persist (transition:persist)
data-astro-transition-persist-props (transition:persist-props)

Note that transition:persist is typed boolean | string, so passing a string value is a supported use of the API.

Proof of Concept

A component that reflects a query parameter into a transition directive:

---
const persist = Astro.url.searchParams.get('persist') ?? 'default';
---
<Island client:load transition:persist={persist} />

Request:

https://example.com/?persist="><img src=x onerror=alert(document.domain)>

Rendered output (before the fix):

<astro-island … data-astro-transition-persist=""><img src=x onerror=alert(document.domain)>></astro-island>

The " closes the attribute and the injected <img onerror=…> executes in the victim's browser.

Impact

Reflected XSS. An attacker who can induce a victim to visit a crafted URL can execute arbitrary script in the victim's session on the origin, subject to the requirement that the target application reflects untrusted input into one of the affected transition directives.

Affected Versions

astro >= 3.10.0, < 7.0.4 (introduced in 3.10.0, PR #7861).

Patched Versions

astro >= 7.0.4. Fixed in PR #17212 by HTML-escaping transition directive values before they are rendered onto the island element.

Workarounds

Do not pass untrusted or request-derived input into transition:persist, transition:scope, or transition:persist-props. If such input is required, HTML-escape or strictly validate it before passing it to the directive. Upgrading to astro@7.0.4 or later removes the need for manual mitigation.

Credits

Reported by @jlgore.

Severity

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "astro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.10.0"
            },
            {
              "fixed": "7.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59727"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79",
      "CWE-83"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T23:21:02Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\n\nWhen a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a client-hydrated (`client:*`) component, Astro copied the directive value onto the rendered `\u003castro-island\u003e` element **without HTML-escaping it**. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).\n\n### Severity\n\nAlthough a generic reflected XSS scores in the Medium range, exploitation here requires the application developer to have written a non-idiomatic pattern \u2014 passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This mitigating precondition places the real-world severity at Low.\n\n### Details\n\nIn `generateHydrateScript()` (`packages/astro/src/runtime/server/hydration.ts`), every island property is HTML-escaped before serialization \u2014 the `attrs`, `props`, and `opts` assignments all pass through `escapeHTML()`. The transition directives, however, were copied verbatim:\n\n```ts\ntransitionDirectivesToCopyOnIsland.forEach((name) =\u003e {\n  if (typeof props[name] !== \u0027undefined\u0027) {\n    island.props[name] = props[name]; // not escaped\n  }\n});\n```\n\nThe `\u003castro-island\u003e` element is serialized via `renderElement(\u0027astro-island\u0027, island, false)` with `shouldEscape=false`, and `toAttributeString()` returns the value unchanged in that mode. As a result there is no downstream re-escaping, and the raw directive value reaches the HTML response. This is the same output sink previously addressed for slot names in GHSA-8hv8-536x-4wqp.\n\nThe affected directives are:\n\n- `data-astro-transition-scope` (`transition:scope`)\n- `data-astro-transition-persist` (`transition:persist`)\n- `data-astro-transition-persist-props` (`transition:persist-props`)\n\nNote that `transition:persist` is typed `boolean | string`, so passing a string value is a supported use of the API.\n\n### Proof of Concept\n\nA component that reflects a query parameter into a transition directive:\n\n```astro\n---\nconst persist = Astro.url.searchParams.get(\u0027persist\u0027) ?? \u0027default\u0027;\n---\n\u003cIsland client:load transition:persist={persist} /\u003e\n```\n\nRequest:\n\n```\nhttps://example.com/?persist=\"\u003e\u003cimg src=x onerror=alert(document.domain)\u003e\n```\n\nRendered output (before the fix):\n\n```html\n\u003castro-island \u2026 data-astro-transition-persist=\"\"\u003e\u003cimg src=x onerror=alert(document.domain)\u003e\u003e\u003c/astro-island\u003e\n```\n\nThe `\"` closes the attribute and the injected `\u003cimg onerror=\u2026\u003e` executes in the victim\u0027s browser.\n\n### Impact\n\nReflected XSS. An attacker who can induce a victim to visit a crafted URL can execute arbitrary script in the victim\u0027s session on the origin, subject to the requirement that the target application reflects untrusted input into one of the affected transition directives.\n\n### Affected Versions\n\n`astro \u003e= 3.10.0, \u003c 7.0.4` (introduced in 3.10.0, PR #7861).\n\n### Patched Versions\n\n`astro \u003e= 7.0.4`. Fixed in PR #17212 by HTML-escaping transition directive values before they are rendered onto the island element.\n\n### Workarounds\n\nDo not pass untrusted or request-derived input into `transition:persist`, `transition:scope`, or `transition:persist-props`. If such input is required, HTML-escape or strictly validate it before passing it to the directive. Upgrading to `astro@7.0.4` or later removes the need for manual mitigation.\n\n### Credits\n\nReported by @jlgore.",
  "id": "GHSA-7pw4-f3q4-r2p2",
  "modified": "2026-07-20T23:21:02Z",
  "published": "2026-07-20T23:21:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/pull/17212"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withastro/astro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/releases/tag/astro@7.0.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-59727 (GCVE-0-2026-59727)

GHSA-7PW4-F3Q4-R2P2

Summary

Severity

Details

Proof of Concept

Impact

Affected Versions

Patched Versions

Workarounds

Credits

Tags

Sightings

Nomenclature