PT-2026-49739 · Astro · Astro

Texuguinho1234 · CVE-2026-54298 · Published 2026-06-16 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Astro versions prior to 6.4.6

Description The spreadAttributes function in the server-side rendering pipeline iterates over object keys and passes them to the addAttribute() function, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax {...props} on an HTML element and the object keys originate from untrusted sources such as APIs, CMS, or URL parameters, an attacker can inject arbitrary HTML attributes. This includes event handlers like onmousemove and onclick, or breaking out of the attribute context to inject new elements, leading to cross-site scripting (XSS).

Recommendations Update to version 6.4.6. As a temporary workaround, avoid using the spread syntax {...props} on HTML elements when the object keys come from untrusted sources.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-54298

GHSA-JRPJ-WCV7-9FH9

Affected Products

Astro

References · 8

• 🔥 https://github.com/withastro/astro/security/advisories/GHSA-jrpj-wcv7-9fh9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54298.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54298 · Security Note
• https://osv.dev/vulnerability/GHSA-jrpj-wcv7-9fh9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-54298 · Vendor Advisory
• https://github.com/withastro/astro · Note
• https://t.me/CVEtracker/61379 · Telegram Post
• https://t.me/cveNotify/173145 · Telegram Post