{"id":"EUVD-2026-107411","enisaUuid":"9d1fa8d1-d0e0-3040-86fb-6d6f97e9dcfe","description":"Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro\u0027s JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes attacker-controlled data directly as a dynamic child can allow a value containing a closing script or style tag to terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escape dynamic strings automatically; the issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components. Successful exploitation can produce reflected or stored cross-site scripting under the application\u0027s origin. This issue is fixed in 7.3.2.","datePublished":"Oct 21, 2026, 5:32:28 PM","dateUpdated":"Oct 23, 2026, 3:11:02 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-98hj-9722-w3j8\nhttps://github.com/withastro/astro/pull/17896\nhttps://github.com/withastro/astro/commit/a548223607b9bb146d5d90ddda495343f9a2a739\nhttps://github.com/withastro/astro/releases/tag/astro@7.3.2\n","aliases":"CVE-2026-114128\nGHSA-98hj-9722-w3j8\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"cd82e42c-125e-3ec1-98c7-55c7a5800e8d","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 7.3.2"}],"enisaIdVendor":[{"id":"b45bdc12-c642-3e57-8a90-85f2374b928a","vendor":{"name":"withastro"}}],"enisaIdVulnerability":[{"id":"25055a0c-3955-3a1a-8488-8846120f1088","vulnerability":{"id":"GHSA-98hj-9722-w3j8","description":"Astro: Reflected/Stored XSS via unescaped \u003cscript\u003e/\u003cstyle\u003e tag content in JSX/MDX rendering","datePublished":"Oct 22, 2026, 4:30:26 PM","dateUpdated":"Oct 22, 2026, 4:30:26 PM","baseScore":0.0,"references":"https://github.com/withastro/astro/security/advisories/GHSA-98hj-9722-w3j8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114128\nhttps://github.com/withastro/astro/pull/17896\nhttps://github.com/withastro/astro/commit/a548223607b9bb146d5d90ddda495343f9a2a739\nhttps://github.com/withastro/astro\nhttps://github.com/withastro/astro/releases/tag/astro@7.3.2\n","enisa_id":"EUVD-2026-107411\n","aliases":"CVE-2026-114128\nGHSA-98hj-9722-w3j8\n","epss":0.0,"dataProcessed":"Nov 4, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4a8265c2-78c6-387f-a55d-79b534a485fa","vulnerability":{"id":"CVE-2026-114128","description":"Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro\u0027s JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes attacker-controlled data directly as a dynamic child can allow a value containing a closing script or style tag to terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escape dynamic strings automatically; the issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components. Successful exploitation can produce reflected or stored cross-site scripting under the application\u0027s origin. This issue is fixed in 7.3.2.","datePublished":"Oct 21, 2026, 5:32:28 PM","dateUpdated":"Oct 23, 2026, 3:11:02 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-98hj-9722-w3j8\nhttps://github.com/withastro/astro/pull/17896\nhttps://github.com/withastro/astro/commit/a548223607b9bb146d5d90ddda495343f9a2a739\nhttps://github.com/withastro/astro/releases/tag/astro@7.3.2\n","enisa_id":"EUVD-2026-107411\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Nov 4, 2026, 7:14:08 AM","vulnerabilityProduct":[{"id":"c7e88a6b-a17b-3dc5-b51b-7306875b67cd","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 7.3.2"}],"vulnerabilityVendor":[{"id":"094fdf8f-8b3a-3a8c-9703-71cdf626de56","vendor":{"name":"withastro"}}]}}],"enisaIdAdvisory":[]}