CVE-2026-73422

Name of the Vulnerable Software and Affected Versions Astro versions 2.9.0 through 7.0.9

Description The server-side View Transition CSS generator interpolates animation properties into an inline style element without proper escaping for CSS and HTML contexts. An attacker can provide a malicious value for animation properties, such as duration, to terminate the style element and inject arbitrary HTML or JavaScript. This occurs within the packages/astro/src/runtime/server/transition.ts file, where the renderTransition() function passes sheet.toString() into markHTMLString(), and the addAnimationProperty() function serializes duration via toTimeValue() while also handling easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition, potentially allowing the execution of arbitrary JavaScript in the application's origin to access sensitive data or perform authenticated actions.

Recommendations Update to version 7.1.0.