CVE-2026-54298

Name of the Vulnerable Software and Affected Versions Astro versions prior to 6.4.6

Description The spreadAttributes function in the server-side rendering pipeline iterates over object keys and passes them to the addAttribute() function, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax {...props} on an HTML element and the object keys originate from untrusted sources such as APIs, CMS, or URL parameters, an attacker can inject arbitrary HTML attributes. This includes event handlers like onmousemove and onclick, or breaking out of the attribute context to inject new elements, leading to cross-site scripting (XSS).

Recommendations Update to version 6.4.6. As a temporary workaround, avoid using the spread syntax {...props} on HTML elements when the object keys come from untrusted sources.