PT-2026-34233 · Astro · Astro

Offset · Published 2026-04-21 · Updated 2026-04-24 · CVE-2026-41067

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Astro versions prior to 6.1.6

Description The defineScriptVars() function in the server-side rendering pipeline uses a case-sensitive regular expression to sanitize values injected into inline <script> tags via the define:vars directive. Because HTML parsers process closing script elements case-insensitively and allow whitespace or a forward slash before the closing bracket, the sanitization can be bypassed. An attacker can use payloads such as </Script>, </script >, or </script/> to prematurely close the script block and inject arbitrary HTML or JavaScript into the page.

Recommendations Update to version 6.1.6. As a temporary workaround, restrict the use of the define:vars directive when passing user-controlled input to <script> tags.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41067

GHSA-J687-52P2-XCFF

Affected Products

Astro

References · 6

• 🔥 https://github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff · Exploit
• https://osv.dev/vulnerability/GHSA-j687-52p2-xcff · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41067 · Security Note
• https://github.com/withastro/astro · Note
• https://github.com/withastro/astro/releases/tag/astro@6.1.6 · Note
• https://twitter.com/CVEnew/status/2047731890388385837 · Twitter Post