CVE-2026-59727: withastro Astro reflected XSS in transition directives

CVE-2026-59727 · Severity: medium · CVSS 4 · Published 2026-07-27

Astro is a web framework used for building content-driven websites. A vulnerability exists where certain transition directives (used for maintaining state between page loads) do not properly clean user-provided data before displaying it on a page. If a developer allows untrusted user input to be passed directly into these directives, an attacker could execute malicious scripts in a victim's browser, potentially leading to unauthorized actions or data theft.

Technologies: astro (npm). Vendors: npm.

Quick answers

Is CVE-2026-59727 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59727 being exploited in the wild.
How severe is CVE-2026-59727?
Medium severity, with a CVSS score of 4, published 27 July 2026.
Which products and versions are affected?
astro (npm) >= 3.10.0, < 7.0.4, SEMVER:introduced=3.10.0,fixed=7.0.4.
Is there a fix for CVE-2026-59727?
Yes. astro (npm): upgrade to 7.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59727 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59727?
Check whether you run astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • astro (npm): upgrade to 7.0.4 or later
    npm install astro@7.0.4

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's server-side hydration logic. When the transition:persist, transition:scope, or transition:persist-props directives are applied to a client-hydrated component, the framework copies the directive values onto the <astro-island> element without HTML-escaping. This occurs in the generateHydrateScript() function within packages/astro/src/runtime/server/hydration.ts. An attacker can exploit this by providing a crafted string (e.g., via query parameters) that breaks out of the HTML attribute to inject arbitrary JavaScript. Exploitation requires a non-idiomatic coding pattern where developers reflect request-derived input directly into these directives. The issue is fixed in version 7.0.4 by ensuring all transition directive values are HTML-escaped during rendering.

Affected products

  • withastro Astro >= 3.10.0, < 7.0.4

Identifiers

  • CVE-2026-59727
  • GHSA-7pw4-f3q4-r2p2

Timeline

  • 2026-06-26: disclosed: Pull request submitted to fix the escaping issue.
  • 2026-06-30: patched: Version 7.0.4 released.
  • 2026-07-17: advisory: GitHub Security Advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.