CyberRota Analysis
AI-GeneratedAstro versions 3.10.0 through 7.0.3 are vulnerable to reflected cross-site scripting (XSS) due to improper handling of directive values in client-hydrated components, allowing attackers to inject arbitrary HTML/JavaScript if untrusted input is reflected in transition directives. Developers using these versions should prioritize updating to version 7.0.4 to mitigate the risk, especially if their applications handle untrusted input in a non-idiomatic manner. Applications that do not route untrusted input into these directives remain unaffected.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.