CVE-2026-126361

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5.

• CWE-79
• CWE-184

• https://github.com/withastro/astro/commit/e023abac912d7cb6af2b9fb5107ef5dabc667096
• https://github.com/withastro/astro/pull/18520
• https://github.com/withastro/astro/releases/tag/astro@7.4.5
• https://github.com/withastro/astro/security/advisories/GHSA-mh32-jxcr-mh9f

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126355Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126356Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126357Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126358Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126359Hono is a Web application framework that provides support fo…3.4
• CVE-2026-126360OpenTelemetry Python provides the Python API and SDK for Ope…5.3
• CVE-2026-126362Astro is a web framework for content-driven websites. From 5…2.3
• CVE-2026-126363Astro is a web framework for content-driven websites. From 0…2.3
• CVE-2026-126364Astro is a web framework for content-driven websites. From 5…6.3
• CVE-2026-126365Astro is a web framework for content-driven websites. Prior …5.4
• CVE-2026-126366MessagePack for Ruby is an implementation of the MessagePack…7.5
• CVE-2026-126367@grpc/grpc-js implements the core functionality of gRPC pure…4.8