Floudeciel

**Name of the Vulnerable Software and Affected Versions** Astro versions prior to 6.3.3 **Description** When a component utilizes a `client:*` directive, the software inserts named slot content into a `data-astro-template` attribute without performing HTML escaping on the slot name. This allows an attacker to break out of the attribute context and inject arbitrary HTML, leading to reflected Cross-Site Scripting (XSS) during Server-Side Rendering (SSR), which is the process of rendering web pages on the server instead of the browser. **Recommendations** Update to version 6.3.3.