CVE-2026-41067: Astro: XSS in define:vars via incomplete </script> tag sanitization

CVE-2026-41067 · Severity: medium · CVSS 6.1 · Published 2026-04-24

Astro is a web framework that allows developers to pass variables into inline script tags via the define:vars directive. A flaw in the sanitization logic fails to block certain HTML-valid variations of closing script tags (case variations, whitespace, slashes), allowing attackers to inject arbitrary JavaScript that executes in users' browsers. This enables session hijacking, credential theft, and malware injection on affected applications that use SSR with user-controlled input.

Technologies: Astro, astro (npm). Vendors: Astro, npm.

Quick answers

Is CVE-2026-41067 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41067 being exploited in the wild.
How severe is CVE-2026-41067?
Medium severity, with a CVSS score of 6.1, published 24 April 2026.
Which products and versions are affected?
astro (npm) < 6.1.6, SEMVER:introduced=0,fixed=6.1.6.
Is there a fix for CVE-2026-41067?
Yes. astro (npm): upgrade to 6.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41067 attacked?
It is attacked over the network.
Am I affected by CVE-2026-41067?
Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • astro (npm): upgrade to 6.1.6 or later
    npm install astro@6.1.6

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the defineScriptVars function in packages/astro/src/runtime/server/render/util.ts. The function uses a case-sensitive regex pattern (/&lt;\/script&gt;/g) to sanitize values injected into script tags, but HTML parsers accept closing script tags case-insensitively and with whitespace or forward slashes before the closing bracket (e.g., &lt;/Script&gt;, &lt;/script &gt;, &lt;/script/&gt;). An attacker can bypass sanitization by crafting payloads using these variations, break out of the script context, and inject arbitrary HTML/JavaScript. The attack requires SSR to be enabled and user input to be passed through define:vars on a script element—a documented usage pattern. Fixes are available in Astro 6.1.6; the recommended patch escapes all &lt; characters using \u003c to prevent all closing tag variants.

Affected products

  • Astro Astro &lt;= 6.1.1

Identifiers

  • CVE-2026-41067
  • GHSA-j687-52p2-xcff

Timeline

  • 2026-04-21: disclosed: GHSA-j687-52p2-xcff published
  • 2026-04-21: patched: Fix released in Astro 6.1.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.