CVE-2026-59729

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6.

• CWE-79

• https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d
• https://github.com/withastro/astro/pull/17251
• https://github.com/withastro/astro/releases/tag/astro@7.0.6
• https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5
• https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5

Published

Jul 27, 2026

Last Modified

Jul 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59723Cline is an autonomous coding agent as an SDK, IDE extension…8.8
• CVE-2026-59724Socket.IO enables bidirectional and low-latency communicatio…7.5
• CVE-2026-59725Socket.IO enables bidirectional and low-latency communicatio…7.5
• CVE-2026-59726Ruflo is an agent meta-harness for Claude Code and Codex. Pr…10
• CVE-2026-59727Astro is a web framework for content-driven websites. In ver…2.1
• CVE-2026-59728Astro is a web framework for content-driven websites. In ver…4.3
• CVE-2026-5973A vulnerability was found in FoundationAgents MetaGPT up to …9.8
• CVE-2026-59730Astro is a web framework for content-driven websites. In ver…2.1
• CVE-2026-59731Astro is a web framework for content-driven websites. Versio…8.2
• CVE-2026-59732Rclone is a command-line program to sync files and directori…5
• CVE-2026-59733Rclone is a command-line program to sync files and directori…8.8
• CVE-2026-59734Coolify is an open-source and self-hostable tool for managin…8.8