CVSS 2.3 (low) · published 2026-11-13
Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2.
Weakness: CWE-79
Source: NVD CVE-2026-126362
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.