Is CVE-2026-114128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114128 being exploited in the wild.

How severe is CVE-2026-114128?

Medium severity, with a CVSS score of 6.5, published 21 October 2026.

Which products and versions are affected?

Astro before 7.3.2; astro (npm) < 7.3.2, SEMVER:introduced=0,fixed=7.3.2.

Is there a fix for CVE-2026-114128?

Yes. astro (npm): upgrade to 7.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114128 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114128?

Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114128: Astro HTML injection in script and style element rendering

Q: Is there a fix for CVE-2026-114128?

Yes. astro (npm): upgrade to 7.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114128 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-114128?

Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114128 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Astro is a web framework for building content-driven websites with JSX and MDX components. Before version 7.3.2, if an application passes untrusted user data as content inside script or style tags, an attacker can inject arbitrary HTML and JavaScript code that executes under the site's origin. This can lead to account takeover, data theft, or malware distribution to the site's visitors.

Technologies: Astro, astro (npm). Vendors: Astro, npm.

Quick answers

Is CVE-2026-114128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114128 being exploited in the wild.
How severe is CVE-2026-114128?: Medium severity, with a CVSS score of 6.5, published 21 October 2026.
Which products and versions are affected?: Astro before 7.3.2; astro (npm) < 7.3.2, SEMVER:introduced=0,fixed=7.3.2.
Is there a fix for CVE-2026-114128?: Yes. astro (npm): upgrade to 7.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114128 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114128?: Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

astro (npm): upgrade to 7.3.2 or later
```
npm install astro@7.3.2
```

Technical details

The vulnerability exists in Astro's JSX and MDX rendering pipeline, which fails to escape dynamic string values when they appear as children of script and style elements. An attacker can craft input containing a closing script or style tag followed by arbitrary HTML/JavaScript to break out of the element and inject malicious content. While other JSX contexts automatically escape dynamic strings, the astro:jsx renderer incorrectly treats dynamic script and style children as trusted markup, enabling reflected or stored XSS attacks.

Affected products

Astro Astro before 7.3.2

Identifiers

CVE-2026-114128
GHSA-98hj-9722-w3j8

Timeline

2026-10-21: disclosed: CVE-2026-114128 published
2026-09-08: patched: Fix committed and merged

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.