{"id":"CVE-2026-73422","sourceIdentifier":"security-advisories@github.com","published":"2026-08-12T21:17:41.187","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition and can execute arbitrary JavaScript in the affected application's origin, allowing access to sensitive page data and authenticated actions available to the victim. This issue is fixed in version 7.1.0."},{"lang":"es","value":"Astro es un framework web para sitios web basados en contenido. Desde la versión 2.9.0 hasta la 7.1.0, el generador CSS de View Transition del lado del servidor de Astro interpola propiedades de animación en un elemento de estilo en línea sin escaparlas para contextos CSS y HTML. Un valor de animación de View Transition controlado por el atacante, como la duración, puede terminar el elemento de estilo generado e inyectar HTML o JavaScript arbitrario. El código afectado es packages/astro/src/runtime/server/transition.ts; renderTransition pasa sheet.toString() a markHTMLString(), mientras que addAnimationProperty serializa la duración a través de toTimeValue() y también maneja easing, direction, delay, fillMode y name. La explotación requiere que una ruta bajo demya o renderizada por el servidor pase datos controlados por el atacante a una definición de animación de View Transition y puede ejecutar JavaScript arbitrario en el origen de la aplicación afectada, permitiendo el acceso a datos sensibles de la página y acciones autenticadas disponibles para la víctima. Este problema está solucionado en la versión 7.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"withastro","product":"astro","versions":[{"version":">= 2.9.0, < 7.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T22:12:08.649209Z","id":"CVE-2026-73422","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/withastro/astro/commit/092da560eea77ee63a3e2c583c80d8238544e42b","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/pull/17393","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/releases/tag/astro@7.1.0","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}