{"id":"EUVD-2026-25573","enisaUuid":"84f6789b-86cc-37b0-b89c-fe4cc548ad26","description":"Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro\u0027s server-side rendering pipeline uses a case-sensitive regex /\u003c\\/script\u003e/g to sanitize values injected into inline \u003cscript\u003e tags via the define:vars directive. HTML parsers close \u003cscript\u003e elements case-insensitively and also accept whitespace or / before the closing \u003e, allowing an attacker to bypass the sanitization with payloads like \u003c/Script\u003e, \u003c/script \u003e, or \u003c/script/\u003e and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.","datePublished":"Apr 24, 2026, 4:57:22 PM","dateUpdated":"Apr 24, 2026, 6:16:55 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff\n","aliases":"CVE-2026-41067\nGHSA-j687-52p2-xcff\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"5798efa4-c625-31b5-8502-2c15ae59ce27","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 6.1.6"}],"enisaIdVendor":[{"id":"00455486-2cfe-3c48-afcb-669ba1952361","vendor":{"name":"withastro"}}],"enisaIdVulnerability":[{"id":"0ed542e2-7d48-3a07-b069-7f847513ee86","vulnerability":{"id":"CVE-2026-41067","description":"Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro\u0027s server-side rendering pipeline uses a case-sensitive regex /\u003c\\/script\u003e/g to sanitize values injected into inline \u003cscript\u003e tags via the define:vars directive. HTML parsers close \u003cscript\u003e elements case-insensitively and also accept whitespace or / before the closing \u003e, allowing an attacker to bypass the sanitization with payloads like \u003c/Script\u003e, \u003c/script \u003e, or \u003c/script/\u003e and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.","datePublished":"Apr 24, 2026, 4:57:22 PM","dateUpdated":"Apr 24, 2026, 6:16:55 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff\n","enisa_id":"EUVD-2026-25573\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Oct 30, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"fbf0f0e9-c2bb-37ec-b21d-9b7ab36a30a2","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 6.1.6"}],"vulnerabilityVendor":[{"id":"1ac6ccdf-dbbc-3f56-98bb-16c69875889f","vendor":{"name":"withastro"}}]}},{"id":"b559bb5a-2e2e-3b81-b65d-83e4a29a7d79","vulnerability":{"id":"GHSA-j687-52p2-xcff","description":"Astro: XSS in define:vars via incomplete \u003c/script\u003e tag sanitization","datePublished":"Apr 21, 2026, 8:39:49 PM","dateUpdated":"Apr 27, 2026, 4:43:27 PM","baseScore":0.0,"references":"https://github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41067\nhttps://github.com/withastro/astro\nhttps://github.com/withastro/astro/releases/tag/astro@6.1.6\n","enisa_id":"EUVD-2026-25573\n","aliases":"CVE-2026-41067\nGHSA-j687-52p2-xcff\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}