Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114128— Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

Quick assessment

Affected
withastro astro
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Astro 是一个面向内容驱动型网站的 Web 框架。在 7.3.2 版本之前，Astro 的 JSX 和 MDX 渲染管道将 和 元素的字符串子节点视为可信的 HTML，未能区分由编译器生成的字面量内容与动态表达式值。如果应用程序将攻击者控制的数据直接作为动态子节点传入，攻击者便可利用包含闭合的 或 标签的值来提前终止该元素，从而注入任意 HTML 和 JavaScript。其他 JSX 表达式上下文会自动对动态字符串进行转义；此问题仅限于通过 渲染器渲染的 和 子节点，包括 MDX 组件。成功利用该漏洞可在应用

CVSS 6.5 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
withastro astro < 7.3.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114128

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Source: CVE Program / CVE List V5
Vulnerability Description
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes attacker-controlled data directly as a dynamic child can allow a value containing a closing script or style tag to terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escape dynamic strings automatically; the issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components. Successful exploitation can produce reflected or stored cross-site scripting under the application's origin. This issue is fixed in 7.3.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
withastro astro < 7.3.2 -

II. Public POCs for CVE-2026-114128

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114128

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114128 (2)

Vendor Advisories for CVE-2026-114128 (1)

Vendor Pages for CVE-2026-114128 (1)

IV. Related Vulnerabilities

Same product: astro
Same vendor: withastro
Same weakness: CWE-79

V. Comments for CVE-2026-114128

No comments yet

Leave a comment