GHSA-jrpj-wcv7-9fh9
Medium · 4.2CVSS
4.2
EPSS
—
Published
Jun 16, 2026
CISA due date
—
The record
Astro: XSS via Unescaped Attribute Names in Spread Props
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | astro | 0 | 6.4.6 |
Related vulnerabilities
- CVE-2026-54298 Astro is a web framework. Same vulnerability
- CVE-2026-54299 Astro is a web framework. Also affects astro
- CVE-2026-50146 Astro is a web framework. Also affects astro
- GHSA-2pvr-wf23-7pc7 Astro: Host header SSRF in prerendered error page fetch Also affects astro
- GHSA-8hv8-536x-4wqp Astro: Reflected XSS via unescaped slot name Also affects astro
- CVE-2026-45028 Astro is a web framework. Also affects astro
- GHSA-xr5h-phrj-8vxv Astro: Server island encrypted parameters vulnerable to cross-component replay Also affects astro
- CVE-2026-41067 Astro is a web framework. Also affects astro