{"id":"CVE-2026-114128","title":"astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements (CVE-2026-114128)","summary":"A flaw was found in Astro. The rendering engine fails to properly sanitize dynamic values placed inside script and style elements, mistakenly treating them as trusted markup. A remote attacker can exploit this issue by supplying crafted in…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"vendor","cwe":"CWE-79","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["openshift_ai_rhoai"],"patched":["astro 7.3.2"],"published":"2026-10-21","updated":"2026-10-23","sourceUpdated":"2026-10-23T17:24:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114128.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114128.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-114128"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558417"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114128"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114128"},{"url":"https://github.com/withastro/astro/commit/a548223607b9bb146d5d90ddda495343f9a2a739"},{"url":"https://github.com/withastro/astro/pull/17896"},{"url":"https://github.com/withastro/astro/releases/tag/astro@7.3.2"},{"url":"https://github.com/withastro/astro/security/advisories/GHSA-98hj-9722-w3j8"},{"url":"https://github.com/advisories/GHSA-98hj-9722-w3j8"}],"tags":["csaf","vex","red-hat","cve.org","ghsa","npm"],"epss":0.00321,"epssPercentile":0.24941,"aliases":["GHSA-98hj-9722-w3j8"],"ecosystem":"npm","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T14:47:55.932392Z"},"scores":{"vendor":6.1,"cna":6.5},"ingestedAt":"2026-10-21T18:09:27.276Z","slug":"CVE-2026-114128","body":"## Overview\n\nA flaw was found in Astro. The rendering engine fails to properly sanitize dynamic values placed inside script and style elements, mistakenly treating them as trusted markup. A remote attacker can exploit this issue by supplying crafted input that prematurely closes the tag and injects malicious code. Successful exploitation can lead to Cross-Site Scripting (XSS), allowing the execution of arbitrary web scripts in the user's browser session.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI) · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114128.json)\n\n**astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements** — rated Moderate by Red Hat. Released 2026-10-21, updated 2026-10-23.\n\nAffected:\n\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-114128)\n\nAffected packages:\n\n- `astro < 7.3.2`\n\nPatched in:\n\n- `astro 7.3.2`\n\nSource: https://github.com/advisories/GHSA-98hj-9722-w3j8","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":228687,"id":"CVE-2026-114128","ts":1792844906376,"field":"cvss","old":"6.5","new":"6.1"}]}