CVE-2026-50146

What it actually does

Astro versions prior to 6.3.3 can place named slot content into a `data-astro-template` HTML attribute without properly escaping the slot name when a component uses a `client:*` hydration directive. If attacker-controlled input can influence the slot name or rendered slot markup during server-side rendering, the attacker can break out of the attribute context and inject arbitrary HTML or JavaScript. The result is reflected cross-site scripting: malicious script executes in the victim’s browser in the context of the affected site after the victim interacts with a crafted page or link.

Why it matters to the business

Successful exploitation can let an attacker run code in users’ browsers, steal session tokens or sensitive page data accessible to JavaScript, perform actions as the user, alter displayed content, or redirect users to phishing pages. Because the issue affects a web framework, exposure depends on whether applications use vulnerable Astro versions, server-side rendering, affected `client:*` component hydration patterns, and attacker-influenced slot names or rendered content. The current EPSS is low and stable, it is not listed in CISA KEV, and no exploit maturity is reported, but public disclosure means affected internet-facing applications should still be upgraded during normal patch cycles.

How an attack unfolds

An attacker first identifies an Astro application running a vulnerable version and looks for pages rendered with SSR that use hydrated components through directives such as `client:load`, `client:idle`, `client:visible`, `client:media`, or similar `client:*` directives. The attacker then finds an input path where user-controlled content can influence named slot output or slot-related markup. They craft a payload that terminates the vulnerable `data-astro-template` attribute and appends attacker-controlled HTML, typically including a script execution primitive such as an event handler, injected element, or script-capable markup. The attacker delivers the malicious URL or input to a victim. When the victim loads the server-rendered page, Astro emits the unescaped slot name into the attribute, the browser interprets the injected markup, and the payload executes in the security context of the affected site. The attacker can then steal data available to the page, perform unauthorized user actions, or modify the page content shown to the victim.

How to fix it

Upgrade Astro to version 6.3.3 or later. If immediate upgrade is not possible, reduce exposure by avoiding attacker-controlled values in slot names or slot-rendered markup, disabling or refactoring affected hydrated components that use `client:*` directives in SSR-rendered pages, and applying strict output encoding for any user-influenced content before it reaches component slot names or rendered attributes. Add or tighten a Content Security Policy that blocks inline script execution where feasible, but treat CSP as a defense-in-depth mitigation rather than a substitute for upgrading. Rebuild and redeploy affected applications after updating the dependency, and ensure lockfiles and container images are refreshed so the deployed artifact actually contains the fixed Astro version.

How to confirm the fix worked

Confirm the installed Astro package version is 6.3.3 or later using package manager metadata, lockfiles, build logs, and deployed artifact inspection. For npm-based projects, review `package.json`, `package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock` for `astro` versions earlier than 6.3.3. Rebuild the application and verify the production bundle was generated after the upgrade. Test representative SSR pages using hydrated components with `client:*` directives and named slots, then inspect the rendered HTML to confirm slot names are safely escaped inside `data-astro-template` attributes. Security validation can include a controlled XSS regression test using benign payloads such as attribute-breakout strings that should render harmlessly as text rather than executable markup.

Typical attack path

1. Identify an application built with Astro prior to version 6.3.3.
2. Confirm the application uses server-side rendering and hydrated components with `client:*` directives.
3. Find a route, parameter, CMS field, preview feature, or user-generated content path that can influence named slot content or slot-related markup.
4. Craft an XSS payload that breaks out of the `data-astro-template` attribute context and injects HTML or JavaScript-capable markup.
5. Deliver the crafted URL or content to a victim, requiring the victim to view or interact with the affected page.
6. Execute JavaScript in the victim’s browser under the affected site’s origin.
7. Use the browser context to steal accessible data, abuse the victim’s session, alter page content, or redirect the user.

How to detect it

Because this is reflected XSS, exploitation may leave few server-side artifacts unless request URLs, query strings, form bodies, referrers, or rendered-error telemetry are logged. Review web server, CDN, WAF, reverse proxy, application, and RUM/browser error logs for requests to SSR-rendered Astro pages containing attribute-breakout or script-injection patterns. Focus on routes that render hydrated components using `client:*` directives and named slots. Look for payloads containing `data-astro-template`, quote characters followed by HTML tags, event-handler attributes such as `onerror=` or `onload=`, `javascript:` URLs, encoded variants of `<script`, and attempts to inject `iframe`, `svg`, `img`, or `template` elements. If client-side telemetry is available, investigate reports of unexpected script errors, blocked CSP violations, or network beacons to unfamiliar domains after visits to affected pages. For forensic review, compare suspicious requests against user session activity to identify users who clicked crafted links and consider rotating exposed tokens if sensitive browser-accessible data may have been accessed.

• data-astro-template
• %3Cscript
• <script
• </script>
• onerror=
• onload=
• onclick=
• onmouseover=
• javascript:
• %22%3E%3C
• "><
• '"`><
• <img
• <svg
• <iframe
• document.cookie
• localStorage
• sessionStorage
• fetch(
• new Image(
• eval(
• alert(
• confirm(
• prompt(
• client:load
• client:idle
• client:visible
• client:media

What your security team should do

• Inventory applications and repositories that depend on Astro, prioritizing internet-facing SSR applications.
• Upgrade Astro to 6.3.3 or later and redeploy rebuilt artifacts.
• Search source code for hydrated components using `client:*` directives and named slots, then review whether any slot-related values can be influenced by users, CMS content, previews, markdown, MDX, or external data feeds.
• Add a regression test that verifies attribute-context escaping for slot names rendered into `data-astro-template`.
• Review web application logs for suspicious reflected-XSS probing around affected routes, especially payloads attempting to break out of HTML attributes.
• Deploy or strengthen CSP to reduce XSS impact, prioritizing removal of unsafe inline script execution where possible.
• If suspicious activity is found, review affected user sessions, tokens, and privileged browser-accessible workflows for possible abuse.