Astro reflected XSS in View Transition animation properties

Executive brief

Astro is a popular web framework used for building fast, content-focused websites. A vulnerability in its View Transition feature allows attackers to inject malicious scripts into a website if the site uses user-provided data to define animation settings. This could lead to unauthorized actions being performed in a user's browser or the theft of sensitive information from the page.

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's server-side View Transition CSS generator. The root cause is the failure to escape animation properties (such as duration, easing, and delay) before interpolating them into an inline <style> element in the HTML head. An attacker can provide a payload containing a '</style>' sequence to terminate the style block and inject arbitrary HTML or JavaScript. This affects on-demand or server-rendered routes where attacker-controlled data is passed to Astro's View Transition API. The vulnerability is patched in version 7.1.0.

Affected products

• withastro astro >= 2.9.0, <= 7.0.9

Timeline

• 2026-07-17: disclosed: Vulnerability reported and patched in version 7.1.0
• 2026-07-20: advisory: GitHub Advisory published

References

• https://api.github.com/users/Ryoga-exe
• https://github.com/Ryoga-exe
• https://api.github.com/users/Ryoga-exe/gists%7B/gist_id%7D
• https://api.github.com/users/Ryoga-exe/repos
• https://avatars.githubusercontent.com/u/49950206?v=4
• https://api.github.com/users/Ryoga-exe/events%7B/privacy%7D