Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M

CVE-2026-54298Astro: XSS via Unescaped Attribute Names in Spread Props

Medium 4.2

In plain English

A medium-severity cross-site scripting in astro from withastro. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 86.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax {...props} on an HTML element and the object keys come from an untrusted source (API, CMS, URL parameters), an attacker can inject arbitrary HTML attributes including event handlers like onmousemove, onclick, or break out of the attribute context entirely to inject new elements. This vulnerability is fixed in 6.4.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	astro	6.4.6	GHSA-jrpj-wcv7-9fh9

Affected products (as reported)

Vendor	Product	Versions
withastro	astro	< 6.4.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/withastro/astro/security/advisories/GHSA-jrpj-wcv7-9fh9 x_refsource_CONFIRM