Executive brief
Astro is a web framework used for building content-driven websites. A vulnerability exists where certain transition directives (used for maintaining state between page loads) do not properly clean user-provided data before displaying it on a page. If a developer allows untrusted user input to be passed directly into these directives, an attacker could execute malicious scripts in a victim's browser, potentially leading to unauthorized actions or data theft.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's server-side hydration logic. When the transition:persist, transition:scope, or transition:persist-props directives are applied to a client-hydrated component, the framework copies the directive values onto the <astro-island> element without HTML-escaping. This occurs in the generateHydrateScript() function within packages/astro/src/runtime/server/hydration.ts. An attacker can exploit this by providing a crafted string (e.g., via query parameters) that breaks out of the HTML attribute to inject arbitrary JavaScript. Exploitation requires a non-idiomatic coding pattern where developers reflect request-derived input directly into these directives. The issue is fixed in version 7.0.4 by ensuring all transition directive values are HTML-escaped during rendering.
Affected products
- withastro Astro >= 3.10.0, < 7.0.4
Timeline
- 2026-06-26: disclosed: Pull request submitted to fix the escaping issue.
- 2026-06-30: patched: Version 7.0.4 released.
- 2026-07-17: advisory: GitHub Security Advisory published.