PT-2026-40592 · Astro · Astro

Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-45028

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Astro versions prior to 6.1.10

Description AES-GCM encryption used to protect the confidentiality and integrity of server island props and slots parameters did not bind the ciphertext to its intended component or parameter type. This allows an attacker to replay one component's encrypted props (p) value as another component's slots (s) value, or vice versa. Because slots contain raw unescaped HTML while props may contain user-controlled values, this can lead to Cross-Site Scripting (XSS), which is a technique where malicious scripts are injected into trusted websites. This issue occurs when an application uses server islands, two different server island components share the same key name for a prop and a slot, and an attacker has full control over the value of the overlapping prop on a dynamically rendered page.

Recommendations Update to version 6.1.10.

Fix

Weakness Enumeration

CWE-323

Related Identifiers

CVE-2026-45028

GHSA-XR5H-PHRJ-8VXV

Affected Products

Astro

References · 6

• https://osv.dev/vulnerability/GHSA-xr5h-phrj-8vxv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45028 · Security Note
• https://github.com/withastro/astro/commit/3d82220a1549e699e34ed433f3846a919f4c02bd · Note
• https://github.com/withastro/astro/security/advisories/GHSA-xr5h-phrj-8vxv · Note
• https://github.com/withastro/astro · Note
• https://github.com/withastro/astro/pull/16457 · Note