---
id: CVE-2026-114128
title: >-
  astro: astro: Cross-Site Scripting via unescaped dynamic content in script and
  style elements (CVE-2026-114128)
summary: >-
  A flaw was found in Astro. The rendering engine fails to properly sanitize
  dynamic values placed inside script and style elements, mistakenly treating
  them as trusted markup. A remote attacker can exploit this issue by supplying
  crafted in…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: vendor
cwe: CWE-79
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - openshift_ai_rhoai
patched:
  - astro 7.3.2
published: '2026-10-21'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T17:24:38+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114128.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114128.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-114128'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2558417'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-114128'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114128'
  - url: >-
      https://github.com/withastro/astro/commit/a548223607b9bb146d5d90ddda495343f9a2a739
  - url: 'https://github.com/withastro/astro/pull/17896'
  - url: 'https://github.com/withastro/astro/releases/tag/astro@7.3.2'
  - url: 'https://github.com/withastro/astro/security/advisories/GHSA-98hj-9722-w3j8'
  - url: 'https://github.com/advisories/GHSA-98hj-9722-w3j8'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - ghsa
  - npm
epss: 0.00321
epssPercentile: 0.24941
aliases:
  - GHSA-98hj-9722-w3j8
ecosystem: npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T14:47:55.932392Z'
scores:
  vendor: 6.1
  cna: 6.5
ingestedAt: '2026-10-21T18:09:27.276Z'
---

## Overview

A flaw was found in Astro. The rendering engine fails to properly sanitize dynamic values placed inside script and style elements, mistakenly treating them as trusted markup. A remote attacker can exploit this issue by supplying crafted input that prematurely closes the tag and injects malicious code. Successful exploitation can lead to Cross-Site Scripting (XSS), allowing the execution of arbitrary web scripts in the user's browser session.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI) · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114128.json)

**astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements** — rated Moderate by Red Hat. Released 2026-10-21, updated 2026-10-23.

Affected:

- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Red Hat OpenShift AI (RHOAI)

## Remediation

Fix deferred

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

## Package advisory (CVE-2026-114128)

Affected packages:

- `astro < 7.3.2`

Patched in:

- `astro 7.3.2`

Source: https://github.com/advisories/GHSA-98hj-9722-w3j8