CVE-2026-59727

Name of the Vulnerable Software and Affected Versions Astro versions 3.10.0 through 7.0.3

Description Astro fails to HTML-escape values for specific transition directives when applied to client-hydrated components. This occurs within the generateHydrateScript() function, where the transition:persist, transition:scope, and transition:persist-props directives are copied verbatim to the rendered <astro-island> element. If a developer passes untrusted, request-derived input directly into these directives, an attacker can break out of the attribute to inject arbitrary HTML or JavaScript into the server-rendered output, leading to reflected cross-site scripting (XSS). This issue specifically affects the following directives:

Recommendations Update Astro to version 7.0.4 or later. As a temporary workaround, avoid passing untrusted or request-derived input into the transition:persist, transition:scope, or transition:persist-props directives, or strictly validate and HTML-escape such input before use.