CVE-2026-126363

Name of the Vulnerable Software and Affected Versions @astrojs/solid-js versions 0.2.0 through 7.1.1

Description The @astrojs/solid-js renderer fails to HTML-escape the named slot inserted into the name attribute of an <astro-slot> wrapper. This allows a request-controlled slot name containing a quote to terminate the attribute and inject active HTML, leading to reflected cross-site scripting. This occurs when a page passes request-controlled input as a slot name, the Solid component is hydrated using a client:* directive, and the component dynamically accesses the attacker-chosen slot property.

Recommendations Update @astrojs/solid-js to version 7.1.2. As a temporary workaround, avoid using request-controlled input as a slot name or map such input to a fixed set of known slot names before passing it to a component.