CVE-2026-114127Low· 2.3▾ TwilightPoC availableAstro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes att…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 12.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
2.3 → 5.4
low → medium
Last analysed / modified upstream
0.3% → 0.5%
Exploit / PoC code exists
5.4 → 2.3
medium → low
Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, delay, easing, direction, fillMode, or animation names can allow CSS delimiters to terminate the declaration and add attacker-selected rules to the server-rendered page. The generated stylesheet still escapes literal less-than characters, so the injected content cannot terminate the style element or directly inject HTML or JavaScript. The injected CSS can conceal or reposition content, add generated text, and otherwise misrepresent the interface; some applications may also expose data already present in selectable DOM attributes through conditional resource loads. This issue is fixed in 7.3.3.
astro >= 7.1.0, < 7.3.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
astro >= 7.1.0, <= 7.3.2Patched in:
astro 7.3.3Source: https://github.com/advisories/GHSA-mpr7-6m5w-76rw
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59727LowAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
CVE-2026-59729MediumAstro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
GHSA-4g3v-8h47-v7g6MediumAstro: Reflected XSS via unescaped View Transition animation properties
CVE-2026-50146High· 7.1Astro: Reflected XSS via unescaped slot name
CVE-2026-54298Medium· 4.2Astro: XSS via Unescaped Attribute Names in Spread Props
CVE-2026-76182Medium· 6.9In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are …