Packages / astro / Security

ModerateVulnerabilityGHSA-jrpj-wcv7-9fh9Published 16 Jun 2026

Astro: XSS via Unescaped Attribute Names in Spread Props

Affected · astro

  • < 6.4.6

Fixed in

6.4.6

npm install astro@6.4.6

  1. Affected

    0.0.1 – 6.4.5

    688 releases

  2. Fixed

    6.4.6 – 7.4.1

    42 releases, latest

730 stable releases of astro, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.