# CVE-2026-114127: Astro CSS injection in View Transition animation values

Source: https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114127 · Severity: medium · CVSS 4 · Published 2026-10-21

Astro is a web framework used to build content-driven websites. A vulnerability in its View Transition CSS generator allows attackers to inject malicious CSS rules by providing crafted values for animation properties like duration, delay, and easing. An attacker can manipulate the rendered page to hide content, reveal sensitive information, or deceive users about the interface without directly executing JavaScript.

Technologies: [Astro](https://junglewise.ai/threats/technologies/astro-astro), [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [Astro](https://junglewise.ai/threats/vendors/astro), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-114127 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114127 being exploited in the wild.

**How severe is CVE-2026-114127?** Medium severity, with a CVSS score of 4, published 21 October 2026.

**Which products and versions are affected?** Astro 7.1.0 to 7.3.2; astro (npm) >= 7.1.0, <= 7.3.2, SEMVER:introduced=7.1.0,fixed=7.3.3.

**Is there a fix for CVE-2026-114127?** Yes. astro (npm): upgrade to 7.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114127 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114127?** Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 7.3.3 or later

  ```sh
  npm install astro@7.3.3
  ```


## Technical details

The server-side View Transition CSS generator fails to properly escape or validate animation property values (duration, delay, easing, direction, fillMode, animation names), allowing CSS declaration delimiters to be injected. This is a CSS injection vulnerability affecting versions 7.1.0 through 7.3.2. An attacker with control over these properties can inject arbitrary CSS rules, though the implementation still escapes literal less-than characters preventing HTML/JavaScript injection via style element breakout.

## Affected products

- Astro Astro 7.1.0 to 7.3.2

## Identifiers

- CVE-2026-114127
- GHSA-mpr7-6m5w-76rw

## Timeline

- 2026-10-21: disclosed
- 2026-09-15: patched: Fix merged to main branch via PR #17970

## References

- [https://github.com/withastro/astro/commit/0b4dc3a211910b589d3805ab4dfedf11b0e712bb](https://github.com/withastro/astro/commit/0b4dc3a211910b589d3805ab4dfedf11b0e712bb)
- [https://github.com/withastro/astro/pull/17970](https://github.com/withastro/astro/pull/17970)

## Related threats

- [Astro case-sensitive path bypass in image endpoint](https://junglewise.ai/threats/cve-2026-126364-astro-is-a-web-framework-for-content-driven-websites-from-5-14-3)
- [Astro HTML injection in dynamic element rendering](https://junglewise.ai/threats/cve-2026-126361-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)
- [Astro authorization bypass in base path stripping](https://junglewise.ai/threats/cve-2026-84376-astro-authorization-bypass-in-base-path-stripping)