# CVE-2026-59727: withastro Astro reflected XSS in transition directives

Source: https://junglewise.ai/threats/cve-2026-59727-withastro-astro-reflected-xss-in-transition-directives  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-59727 · Severity: medium · CVSS 4 · Published 2026-07-27

Astro is a web framework used for building content-driven websites. A vulnerability exists where certain transition directives (used for maintaining state between page loads) do not properly clean user-provided data before displaying it on a page. If a developer allows untrusted user input to be passed directly into these directives, an attacker could execute malicious scripts in a victim's browser, potentially leading to unauthorized actions or data theft.

Technologies: [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-59727 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59727 being exploited in the wild.

**How severe is CVE-2026-59727?** Medium severity, with a CVSS score of 4, published 27 July 2026.

**Which products and versions are affected?** astro (npm) >= 3.10.0, < 7.0.4, SEMVER:introduced=3.10.0,fixed=7.0.4.

**Is there a fix for CVE-2026-59727?** Yes. astro (npm): upgrade to 7.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59727 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59727?** Check whether you run astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 7.0.4 or later

  ```sh
  npm install astro@7.0.4
  ```


## Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's server-side hydration logic. When the transition:persist, transition:scope, or transition:persist-props directives are applied to a client-hydrated component, the framework copies the directive values onto the <astro-island> element without HTML-escaping. This occurs in the generateHydrateScript() function within packages/astro/src/runtime/server/hydration.ts. An attacker can exploit this by providing a crafted string (e.g., via query parameters) that breaks out of the HTML attribute to inject arbitrary JavaScript. Exploitation requires a non-idiomatic coding pattern where developers reflect request-derived input directly into these directives. The issue is fixed in version 7.0.4 by ensuring all transition directive values are HTML-escaped during rendering.

## Affected products

- withastro Astro >= 3.10.0, < 7.0.4

## Identifiers

- CVE-2026-59727
- GHSA-7pw4-f3q4-r2p2

## Timeline

- 2026-06-26: disclosed: Pull request submitted to fix the escaping issue.
- 2026-06-30: patched: Version 7.0.4 released.
- 2026-07-17: advisory: GitHub Security Advisory published.

## References

- [https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294](https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294)
- [https://github.com/withastro/astro/pull/17212](https://github.com/withastro/astro/pull/17212)
- [https://github.com/withastro/astro/releases/tag/astro@7.0.4](https://github.com/withastro/astro/releases/tag/astro@7.0.4)
- [https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2](https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2)

## Related threats

- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)
- [Astro authorization bypass in base path stripping](https://junglewise.ai/threats/cve-2026-84376-astro-authorization-bypass-in-base-path-stripping)
- [Astro composable astro/hono pipeline CSRF via origin check bypass](https://junglewise.ai/threats/cve-2026-73423-astro-composable-astro-hono-pipeline-csrf-via-origin-check-bypass)