Packages / astro / Security

ModerateVulnerabilityGHSA-f48w-9m4c-m7f5Published 20 Jul 2026

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Affected · astro

  • < 7.0.6

Fixed in

7.0.6

npm install astro@7.0.6

  1. Affected

    0.0.1 – 7.0.5

    697 releases

  2. Fixed

    7.0.6 – 7.4.1

    33 releases, latest

730 stable releases of astro, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.