cve.bz

CVE-2026-126361

Astro: XSS via attribute injection in dynamic tag names

2.3 low

Low (2.3) in withastro astro.

On this page
Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5.

Severity

CVSS 4.0

2.3 low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CWEs
CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
CWE-184 Incomplete List of Disallowed Inputs
OWASP Top 10
A05:2025 Injection
Published
Assigned by
GitHub_M (CNA)
NVD analysis
Not in the NVD yet
Record from
the CVE List, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-126361 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-126361?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-126361?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-126361 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

CVE-2026-126361

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-126361](https://cve.bz/cve/badge/CVE-2026-126361.svg)](https://cve.bz/cve/CVE-2026-126361)

HTML:

<a href="https://cve.bz/cve/CVE-2026-126361"><img src="https://cve.bz/cve/badge/CVE-2026-126361.svg" alt="CVE-2026-126361"></a>

Affected

Versions

From the CNA's record in the CVE List.

ProductAffected
withastro astro< 7.4.5

Attack patterns (CAPEC)

  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
  • CAPEC-592 Stored XSS Likelihood: High · Severity: Very High
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-6 Argument Injection Likelihood: High · Severity: High
  • CAPEC-15 Command Delimiters Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits. More on the page of CWE-184.

References

Check your stackJSON