CVE-2026-50146EPSS p18.8%

CVE-2026-50146CVE-2026-50146

astro / astro

Description

Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.

Scoring

CVSS 7.1 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
EPSS0.27% probability of exploitation · percentile 18.8% · 2026-08-08T12:02:54Z
Last modified2026-06-23
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.