@astrojs/webapi vulnerabilities (TuxCare)

2 vulnerabilities.

• @astrojs/webapi TuxCare Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) CVE-2026-59729 Fix available 5.1 MediumJuly 20, 2026
• @astrojs/webapi TuxCare Astro: Reflected XSS via unescaped View Transition animation properties CVE-2026-73422 Fix available 5.3 MediumJuly 20, 2026