CVE-2026-59729

Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.0.6

Description A cross-site scripting (XSS) issue exists when the software is used with an SSR runtime that exposes a global HTMLElement (such as Deno, Bun with a DOM shim, or jsdom/happy-dom in Node) and a class extending HTMLElement is used as a component receiving untrusted spread props. The renderHTMLElement() function in packages/astro/src/runtime/server/render/dom.ts interpolates attribute names without escaping them, allowing an attacker who controls the keys of an object spread onto a native HTMLElement subclass to inject arbitrary event-handler attributes or sibling elements, such as <script> tags, into the SSR output.

Recommendations Update Astro to version 7.0.6. As a temporary workaround, avoid spreading untrusted object keys onto components that extend the native HTMLElement class.