CVE-2026-126362

Name of the Vulnerable Software and Affected Versions @astrojs/svelte versions 5.7.3 through 9.1.1

Description The @astrojs/svelte renderer fails to HTML-escape named slots inserted into the name attribute of an <astro-slot> wrapper. This allows an attacker to provide a slot name containing a quote character to terminate the attribute and inject arbitrary HTML, leading to reflected cross-site scripting. This occurs when a page passes request-controlled input as a slot name, the Svelte component is hydrated using a client:* directive, and the component dynamically renders the attacker-chosen slot. Both server-side rendering and client-side hydration are affected.

Recommendations Update @astrojs/svelte to version 9.1.2. As a temporary workaround, avoid using request-controlled input as a slot name or map such input to a fixed set of known slot names before passing it to a component.