Improper Encoding or Escaping of Output Affecting astro package, versions <7.0.4
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ASTRO-18085579
- published21 Jul 2026
- disclosed20 Jul 2026
- creditJared Gore
Introduced: 20 Jul 2026
NewCVE-2026-59727 (opens in a new tab)How to fix?
Upgrade astro to version 7.0.4 or higher.
Overview
astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.
Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the transition:persist, transition:scope, or transition:persist-props directives when unescaped values are copied onto the rendered <astro-island> element. An attacker can inject arbitrary HTML or JavaScript into the server-rendered output by supplying crafted input that is reflected into these directives.
Note: This is only exploitable if the application developer passes untrusted, request-derived input directly into a transition directive.
Workaround
This vulnerability can be mitigated by ensuring that untrusted or request-derived input is not passed into transition:persist, transition:scope, or transition:persist-props, or by HTML-escaping or strictly validating such input before use.