CVE-2026-59729: Astro Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f48w-9m4c-m7f5",
  "modified" : "2026-08-12T20:37:31Z",
  "published" : "2026-07-20T23:21:58Z",
  "aliases" : [ "CVE-2026-59729" ],
  "summary" : "Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)",
  "details" : "## Summary\n\nThe fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attribute names containing `\"' >/=` or whitespace are dropped. A second attribute-rendering path, `renderHTMLElement()` in `packages/astro/src/runtime/server/render/dom.ts`, has its own inline attribute loop that does not go through `addAttribute()` and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-`HTMLElement`-subclass component can still break out of the attribute context, resulting in XSS.\n\n## Details\n\n`renderHTMLElement` builds attributes directly:\n\n```js\nfor (const attr in props) {\n  attrHTML += ` ${attr}=\"${toAttributeString(await props[attr])}\"`;\n}\n```\n\nThe attribute name (`attr`) is interpolated raw; only the value is escaped via `toAttributeString`. By contrast, the hardened `addAttribute` in `util.ts` rejects invalid names:\n\n```js\nif (INVALID_ATTR_NAME_CHAR.test(key)) { return ''; } // /[\\s\"'>/=]/\n```\n\n`renderHTMLElement` is reached from `component.ts` when the component is a native `HTMLElement` subclass:\n\n```js\nif (!renderer && typeof HTMLElement === 'function' && componentIsHTMLElement(Component)) {\n  const output = await renderHTMLElement(result, Component, _props, slots);\n}\n```\n\nwhere `_props` carries spread props verbatim.\n\n### Reachability\n\nThe branch only runs when `typeof HTMLElement === 'function'` at SSR time. In default Node SSR `HTMLElement` is `undefined`, so the branch is dead. It becomes reachable when the SSR runtime exposes a global `HTMLElement` (Deno, Bun with a DOM shim, or jsdom/happy-dom in Node) **and** a class extending `HTMLElement` is used directly as an Astro component that receives untrusted-keyed spread props.\n\n## Proof of Concept\n\nGiven malicious spread props:\n\n```js\nconst maliciousProps = {\n  'onmouseover=alert(document.domain) x': 'y',\n  'x><script>alert(1)</script>': 'z',\n};\n```\n\n- `addAttribute` (post-fix) → `<my-el></my-el>` (key stripped — safe)\n- `renderHTMLElement` → `<my-el onmouseover=alert(document.domain) x=\"y\" x><script>alert(1)</script>=\"z\"></my-el>` (handler + `<script>` injected — XSS)\n\nEquivalent Astro template, served by an SSR runtime that defines a global `HTMLElement`:\n\n```astro\n---\nimport MyElement from '../MyElement.js'; // class MyElement extends HTMLElement {}\nconst userInput = Astro.url.searchParams;  // untrusted keys\n---\n<MyElement {...Object.fromEntries(userInput)} />\n```\n\n## Impact\n\nCross-site scripting (CWE-79) via attribute-name breakout — the same vulnerability class as CVE-2026-54298, in a code path its fix did not cover. An attacker who controls the keys of an object spread onto a native-`HTMLElement`-subclass component can inject arbitrary event-handler attributes or sibling elements (including `<script>`) into the SSR output. Reachability is constrained by the runtime and component preconditions described above.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "astro"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "7.0.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59729"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/pull/17251"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/withastro/astro"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/releases/tag/astro@7.0.6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-20T23:21:58Z",
    "nvd_published_at" : "2026-07-27T20:16:40Z"
  }
}