# CVE-2026-126363: Astro @astrojs/solid-js HTML injection in slot names

Source: https://junglewise.ai/threats/cve-2026-126363-astro-reflected-xss-via-unescaped-slot-names-in-astrojs-solid-js  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-13. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-126363 · Severity: medium · CVSS 4 · Published 2026-11-13

Astro is a web framework for building content-driven websites. The @astrojs/solid-js renderer failed to properly escape slot names when rendering components, allowing attackers to inject arbitrary HTML through specially crafted slot names. This could lead to cross-site scripting (XSS) attacks if the application accepts user-controlled slot names and uses hydrated Solid components.

Vendors: [Astro](https://junglewise.ai/threats/vendors/astro), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-126363 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126363 being exploited in the wild.

**How severe is CVE-2026-126363?** Medium severity, with a CVSS score of 4, published 13 November 2026.

**Which products and versions are affected?** Astro @Astrojs/Solid-Js 0.2.0 until 7.1.2; @astrojs/solid-js (npm) >= 0.2.0, <= 7.1.1, SEMVER:introduced=0.2.0,fixed=7.1.2.

**Is there a fix for CVE-2026-126363?** Yes. @astrojs/solid-js (npm): upgrade to 7.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126363 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-126363?** Check whether you run Astro @Astrojs/Solid-Js or @astrojs/solid-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @astrojs/solid-js (npm): upgrade to 7.1.2 or later

  ```sh
  npm install @astrojs/solid-js@7.1.2
  ```


## Technical details

The @astrojs/solid-js renderer inserted slot names directly into the astro-slot wrapper's name attribute without HTML escaping, allowing a quote character in the slot name to break out of the attribute and inject active HTML elements. Exploitation requires a hydrated Solid component using a client:* directive that dynamically accesses an attacker-controlled slot property; components that do not render the malicious slot output only escaped fallback content. The vulnerability is fixed by escaping slot names before insertion into HTML attributes.

## Affected products

- Astro @astrojs/solid-js 0.2.0 until 7.1.2

## Identifiers

- CVE-2026-126363
- GHSA-jmv2-qgxf-f995

## Timeline

- 2026-11-13: disclosed
- 2026-10-28: patched

## References

- [https://github.com/withastro/astro/commit/290b196ddb48de11783ff128e2b7272c61490a20](https://github.com/withastro/astro/commit/290b196ddb48de11783ff128e2b7272c61490a20)
- [https://github.com/withastro/astro/releases/tag/@astrojs/solid-js@7.1.2](https://github.com/withastro/astro/releases/tag/@astrojs/solid-js@7.1.2)