{"id":"CVE-2026-59729","aliases":["CLSA-2026-1784596296","CLSA-2026-1786365605","CLSA-2026-1788892753","CLSA-2026-1788970606","CLSA-2026-1790106019","CLSA-2026-1792161554","CLSA-2026-1792161561","CLSA-2026-1792161693","CLSA-2026-1792161703","CLSA-2026-1792161706","CLSA-2026-1792161712","CLSA-2026-1792161761","CLSA-2026-1792161785","CLSA-2026-1792161790","CLSA-2026-1792161792","CLSA-2026-1792161799","CLSA-2026-1792161854","CLSA-2026-1792161858","CLSA-2026-1792454046","EUVD-2026-49580","GHSA-f48w-9m4c-m7f5"],"status":"published","title":"Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)","description":"Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing \"' \u003e/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00473,"percentile":0.41439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-07-20T23:21:58Z","modified":"2026-11-10T19:45:16Z","fixes":[{"ecosystem":"npm","package":"astro","fixed_in":["7.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"astro","fixed_in":["0.26.1-tuxcare.3","3.6.5-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","fixed_in":["3.6.5-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/prism","fixed_in":["0.26.1-tuxcare.3","3.6.5-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","fixed_in":["3.6.5-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","fixed_in":["3.6.5-tuxcare.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.5"}]}],"versions":["5.18.1","5.18.1-tuxcare.1","5.18.1-tuxcare.2","5.18.1-tuxcare.3","5.18.1-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.3"}]}],"versions":["4.16.19","4.16.19-tuxcare.1","4.16.19-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.3"}]}],"versions":["4.16.19","4.16.19-tuxcare.1","4.16.19-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.3"}]}],"versions":["4.16.19","4.16.19-tuxcare.1","4.16.19-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.3"}]}],"versions":["4.16.19","4.16.19-tuxcare.1","4.16.19-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.3"}]}],"versions":["4.16.19","4.16.19-tuxcare.1","4.16.19-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.1-tuxcare.0"},{"fixed":"0.26.1-tuxcare.3"}]}],"versions":["0.26.1","0.26.1-tuxcare.1","0.26.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.6"}]}],"versions":["3.6.5","3.6.5-tuxcare.1","3.6.5-tuxcare.2","3.6.5-tuxcare.3","3.6.5-tuxcare.4","3.6.5-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.8"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4","2.10.15-tuxcare.5","2.10.15-tuxcare.6","2.10.15-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.8"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4","2.10.15-tuxcare.5","2.10.15-tuxcare.6","2.10.15-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/webapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.8"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4","2.10.15-tuxcare.5","2.10.15-tuxcare.6","2.10.15-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.8"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4","2.10.15-tuxcare.5","2.10.15-tuxcare.6","2.10.15-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.8"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4","2.10.15-tuxcare.5","2.10.15-tuxcare.6","2.10.15-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.5"}]}],"versions":["5.18.1","5.18.1-tuxcare.2","5.18.1-tuxcare.3","5.18.1-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.6"}]}],"versions":["3.6.5","3.6.5-tuxcare.1","3.6.5-tuxcare.2","3.6.5-tuxcare.3","3.6.5-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.5"}]}],"versions":["5.18.1","5.18.1-tuxcare.2","5.18.1-tuxcare.3","5.18.1-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.1-tuxcare.0"},{"fixed":"0.26.1-tuxcare.3"}]}],"versions":["0.26.1","0.26.1-tuxcare.1","0.26.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.6"}]}],"versions":["3.6.5","3.6.5-tuxcare.1","3.6.5-tuxcare.2","3.6.5-tuxcare.3","3.6.5-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.8"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4","2.10.15-tuxcare.5","2.10.15-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/studio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.3"}]}],"versions":["4.16.19","4.16.19-tuxcare.1","4.16.19-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.5"}]}],"versions":["5.18.1","5.18.1-tuxcare.2","5.18.1-tuxcare.3","5.18.1-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.3"}]}],"versions":["4.16.19","4.16.19-tuxcare.1","4.16.19-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.6"}]}],"versions":["3.6.5","3.6.5-tuxcare.1","3.6.5-tuxcare.2","3.6.5-tuxcare.3","3.6.5-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.8"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4","2.10.15-tuxcare.5","2.10.15-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.5"}]}],"versions":["5.18.1","5.18.1-tuxcare.2","5.18.1-tuxcare.3","5.18.1-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.6"}]}],"versions":["3.6.5","3.6.5-tuxcare.1","3.6.5-tuxcare.2","3.6.5-tuxcare.3","3.6.5-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.2-tuxcare.0"},{"fixed":"5.18.2-tuxcare.1"}]}],"versions":["5.18.2"],"bundled":9},{"source":"osv","ecosystem":"npm","package":"astro","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.0.6"}]}]}],"products":[{"vendor":"withastro","product":"astro"}],"references":[{"url":"https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/withastro/astro/pull/17251","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/withastro/astro/releases/tag/astro@7.0.6","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59729","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f48w-9m4c-m7f5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59729.json","tags":["advisory"]},{"url":"https://github.com/withastro/astro","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-59729","title":"Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)","description":"Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing \"' \u003e/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.","status":"published","published":"2026-07-27T19:38:40.372Z","modified":"2026-07-28T13:48:46.64Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-49580","description":"Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing \"' \u003e/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.","status":"published","published":"2026-07-27T19:38:40Z","modified":"2026-07-28T13:48:46Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:31.827348Z"}],"ghsa":[{"id":"GHSA-f48w-9m4c-m7f5","title":"Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)","description":"## Summary\n\nThe fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attribute names containing `\"' \u003e/=` or whitespace are dropped. A second attribute-rendering path, `renderHTMLElement()` in `packages/astro/src/runtime/server/render/dom.ts`, has its own inline attribute loop that does not go through `addAttribute()` and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-`HTMLElement`-subclass component can still break out of the attribute context, resulting in XSS.\n\n## Details\n\n`renderHTMLElement` builds attributes directly:\n\n```js\nfor (const attr in props) {\n  attrHTML += ` ${attr}=\"${toAttributeString(await props[attr])}\"`;\n}\n```\n\nThe attribute name (`attr`) is interpolated raw; only the value is escaped via `toAttributeString`. By contrast, the hardened `addAttribute` in `util.ts` rejects invalid names:\n\n```js\nif (INVALID_ATTR_NAME_CHAR.test(key)) { return ''; } // /[\\s\"'\u003e/=]/\n```\n\n`renderHTMLElement` is reached from `component.ts` when the component is a native `HTMLElement` subclass:\n\n```js\nif (!renderer \u0026\u0026 typeof HTMLElement === 'function' \u0026\u0026 componentIsHTMLElement(Component)) {\n  const output = await renderHTMLElement(result, Component, _props, slots);\n}\n```\n\nwhere `_props` carries spread props verbatim.\n\n### Reachability\n\nThe branch only runs when `typeof HTMLElement === 'function'` at SSR time. In default Node SSR `HTMLElement` is `undefined`, so the branch is dead. It becomes reachable when the SSR runtime exposes a global `HTMLElement` (Deno, Bun with a DOM shim, or jsdom/happy-dom in Node) **and** a class extending `HTMLElement` is used directly as an Astro component that receives untrusted-keyed spread props.\n\n## Proof of Concept\n\nGiven malicious spread props:\n\n```js\nconst maliciousProps = {\n  'onmouseover=alert(document.domain) x': 'y',\n  'x\u003e\u003cscript\u003ealert(1)\u003c/script\u003e': 'z',\n};\n```\n\n- `addAttribute` (post-fix) → `\u003cmy-el\u003e\u003c/my-el\u003e` (key stripped — safe)\n- `renderHTMLElement` → `\u003cmy-el onmouseover=alert(document.domain) x=\"y\" x\u003e\u003cscript\u003ealert(1)\u003c/script\u003e=\"z\"\u003e\u003c/my-el\u003e` (handler + `\u003cscript\u003e` injected — XSS)\n\nEquivalent Astro template, served by an SSR runtime that defines a global `HTMLElement`:\n\n```astro\n---\nimport MyElement from '../MyElement.js'; // class MyElement extends HTMLElement {}\nconst userInput = Astro.url.searchParams;  // untrusted keys\n---\n\u003cMyElement {...Object.fromEntries(userInput)} /\u003e\n```\n\n## Impact\n\nCross-site scripting (CWE-79) via attribute-name breakout — the same vulnerability class as CVE-2026-54298, in a code path its fix did not cover. An attacker who controls the keys of an object spread onto a native-`HTMLElement`-subclass component can inject arbitrary event-handler attributes or sibling elements (including `\u003cscript\u003e`) into the SSR output. Reachability is constrained by the runtime and component preconditions described above.","status":"published","published":"2026-07-20T23:21:58Z","modified":"2026-08-12T20:37:31Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-59729","description":"Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing \"' \u003e/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.","status":"published","published":"2026-07-27T20:16:40.303Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:33.249634Z"}],"osv":[{"id":"CVE-2026-59729","title":"Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)","description":"Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing \"' \u003e/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.","status":"published","published":"2026-07-27T19:38:40.372Z","modified":"2026-10-28T02:31:05.188052514Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-f48w-9m4c-m7f5","title":"Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)","description":"## Summary\n\nThe fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attribute names containing `\"' \u003e/=` or whitespace are dropped. A second attribute-rendering path, `renderHTMLElement()` in `packages/astro/src/runtime/server/render/dom.ts`, has its own inline attribute loop that does not go through `addAttribute()` and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-`HTMLElement`-subclass component can still break out of the attribute context, resulting in XSS.\n\n## Details\n\n`renderHTMLElement` builds attributes directly:\n\n```js\nfor (const attr in props) {\n  attrHTML += ` ${attr}=\"${toAttributeString(await props[attr])}\"`;\n}\n```\n\nThe attribute name (`attr`) is interpolated raw; only the value is escaped via `toAttributeString`. By contrast, the hardened `addAttribute` in `util.ts` rejects invalid names:\n\n```js\nif (INVALID_ATTR_NAME_CHAR.test(key)) { return ''; } // /[\\s\"'\u003e/=]/\n```\n\n`renderHTMLElement` is reached from `component.ts` when the component is a native `HTMLElement` subclass:\n\n```js\nif (!renderer \u0026\u0026 typeof HTMLElement === 'function' \u0026\u0026 componentIsHTMLElement(Component)) {\n  const output = await renderHTMLElement(result, Component, _props, slots);\n}\n```\n\nwhere `_props` carries spread props verbatim.\n\n### Reachability\n\nThe branch only runs when `typeof HTMLElement === 'function'` at SSR time. In default Node SSR `HTMLElement` is `undefined`, so the branch is dead. It becomes reachable when the SSR runtime exposes a global `HTMLElement` (Deno, Bun with a DOM shim, or jsdom/happy-dom in Node) **and** a class extending `HTMLElement` is used directly as an Astro component that receives untrusted-keyed spread props.\n\n## Proof of Concept\n\nGiven malicious spread props:\n\n```js\nconst maliciousProps = {\n  'onmouseover=alert(document.domain) x': 'y',\n  'x\u003e\u003cscript\u003ealert(1)\u003c/script\u003e': 'z',\n};\n```\n\n- `addAttribute` (post-fix) → `\u003cmy-el\u003e\u003c/my-el\u003e` (key stripped — safe)\n- `renderHTMLElement` → `\u003cmy-el onmouseover=alert(document.domain) x=\"y\" x\u003e\u003cscript\u003ealert(1)\u003c/script\u003e=\"z\"\u003e\u003c/my-el\u003e` (handler + `\u003cscript\u003e` injected — XSS)\n\nEquivalent Astro template, served by an SSR runtime that defines a global `HTMLElement`:\n\n```astro\n---\nimport MyElement from '../MyElement.js'; // class MyElement extends HTMLElement {}\nconst userInput = Astro.url.searchParams;  // untrusted keys\n---\n\u003cMyElement {...Object.fromEntries(userInput)} /\u003e\n```\n\n## Impact\n\nCross-site scripting (CWE-79) via attribute-name breakout — the same vulnerability class as CVE-2026-54298, in a code path its fix did not cover. An attacker who controls the keys of an object spread onto a native-`HTMLElement`-subclass component can inject arbitrary event-handler attributes or sibling elements (including `\u003cscript\u003e`) into the SSR output. Reachability is constrained by the runtime and component preconditions described above.","status":"published","published":"2026-07-20T23:21:58Z","modified":"2026-08-12T20:45:07.686847489Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"CLSA-2026-1784596296","title":"TuxCare security update for astro (2 CVEs)","description":"TuxCare rebuilt astro to address 2 CVEs. Fixed in 5.18.1-tuxcare.5.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-30T19:45:59.520158767Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1786365605","title":"TuxCare security update for 5 packages (4 CVEs)","description":"TuxCare rebuilt 5 packages to address 4 CVEs. Fixed in 4.16.19-tuxcare.3.","status":"published","published":"2026-08-10T12:40:05Z","modified":"2026-10-15T09:45:59.848637172Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1788892753","title":"TuxCare security update for astro (1 CVE)","description":"TuxCare rebuilt astro to address 1 CVE. Fixed in 0.26.1-tuxcare.3.","status":"published","published":"2026-09-08T18:39:13Z","modified":"2026-10-30T19:46:01.570043295Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788970606","title":"TuxCare security update for astro (1 CVE)","description":"TuxCare rebuilt astro to address 1 CVE. Fixed in 3.6.5-tuxcare.6.","status":"published","published":"2026-09-09T16:16:46Z","modified":"2026-10-30T19:46:02.545696893Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1790106019","title":"TuxCare security update for 5 packages (3 CVEs)","description":"TuxCare rebuilt 5 packages to address 3 CVEs. Fixed in 2.10.15-tuxcare.8.","status":"published","published":"2026-09-22T19:40:19Z","modified":"2026-10-15T09:47:14.558504253Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1792161554","title":"TuxCare security update for @astrojs/internal-helpers (2 CVEs)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 2 CVEs. Fixed in 5.18.1-tuxcare.5.","status":"published","published":"2026-10-16T14:39:14Z","modified":"2026-10-16T16:31:04.484490836Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161561","title":"TuxCare security update for @astrojs/internal-helpers (1 CVE)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 1 CVE. Fixed in 3.6.5-tuxcare.6.","status":"published","published":"2026-10-16T14:39:21Z","modified":"2026-10-16T16:31:04.485799838Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161693","title":"TuxCare security update for @astrojs/prism (2 CVEs)","description":"TuxCare rebuilt @astrojs/prism to address 2 CVEs. Fixed in 5.18.1-tuxcare.5.","status":"published","published":"2026-10-16T14:41:33Z","modified":"2026-10-16T16:31:14.350467009Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161703","title":"TuxCare security update for @astrojs/prism (1 CVE)","description":"TuxCare rebuilt @astrojs/prism to address 1 CVE. Fixed in 0.26.1-tuxcare.3.","status":"published","published":"2026-10-16T14:41:43Z","modified":"2026-10-16T16:31:14.3529286Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161706","title":"TuxCare security update for @astrojs/prism (1 CVE)","description":"TuxCare rebuilt @astrojs/prism to address 1 CVE. Fixed in 3.6.5-tuxcare.6.","status":"published","published":"2026-10-16T14:41:46Z","modified":"2026-10-16T16:31:08.224235444Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161712","title":"TuxCare security update for @astrojs/prism (1 CVE)","description":"TuxCare rebuilt @astrojs/prism to address 1 CVE. Fixed in 2.10.15-tuxcare.8.","status":"published","published":"2026-10-16T14:41:52Z","modified":"2026-11-10T19:45:14.500772557Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161761","title":"TuxCare security update for @astrojs/studio (1 CVE)","description":"TuxCare rebuilt @astrojs/studio to address 1 CVE. Fixed in 4.16.19-tuxcare.3.","status":"published","published":"2026-10-16T14:42:41Z","modified":"2026-11-10T19:45:16.395932987Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161785","title":"TuxCare security update for @astrojs/underscore-redirects (2 CVEs)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 2 CVEs. Fixed in 5.18.1-tuxcare.5.","status":"published","published":"2026-10-16T14:43:05Z","modified":"2026-10-16T16:30:29.17168201Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161790","title":"TuxCare security update for @astrojs/underscore-redirects (1 CVE)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 1 CVE. Fixed in 4.16.19-tuxcare.3.","status":"published","published":"2026-10-16T14:43:10Z","modified":"2026-11-10T19:45:12.855494469Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161792","title":"TuxCare security update for @astrojs/underscore-redirects (1 CVE)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 1 CVE. Fixed in 3.6.5-tuxcare.6.","status":"published","published":"2026-10-16T14:43:12Z","modified":"2026-10-16T16:30:29.175199146Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161799","title":"TuxCare security update for @astrojs/underscore-redirects (1 CVE)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 1 CVE. Fixed in 2.10.15-tuxcare.8.","status":"published","published":"2026-10-16T14:43:19Z","modified":"2026-11-10T19:45:15.425276137Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161854","title":"TuxCare security update for @astrojs/upgrade (2 CVEs)","description":"TuxCare rebuilt @astrojs/upgrade to address 2 CVEs. Fixed in 5.18.1-tuxcare.5.","status":"published","published":"2026-10-16T14:44:14Z","modified":"2026-10-16T16:31:16.215381545Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161858","title":"TuxCare security update for @astrojs/upgrade (1 CVE)","description":"TuxCare rebuilt @astrojs/upgrade to address 1 CVE. Fixed in 3.6.5-tuxcare.6.","status":"published","published":"2026-10-16T14:44:18Z","modified":"2026-10-16T16:31:15.814835554Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792454046","title":"TuxCare security update for astro (9 CVEs)","description":"TuxCare rebuilt astro to address 9 CVEs. Fixed in 5.18.2-tuxcare.1.","status":"published","published":"2026-10-19T23:54:06Z","modified":"2026-10-20T01:45:16.00100881Z","updated_at":"2026-11-02T15:43:54.378946Z"}]}}