{"affected":[{"product":"astro","source":"CNA: GitHub_M","vendor":"withastro","versions":[{"status":"affected","version":">= 5.7.3, < 9.1.2"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@astrojs/svelte","product":"@astrojs/svelte","source":"OSV GHSA-f4j9-crrj-867q","vendor":"","versions":[{"events":[{"introduced":"5.7.3"},{"fixed":"9.1.2"}],"lessThan":"9.1.2","status":"affected","version":"5.7.3","versionType":"semver"}]}],"cveId":"CVE-2026-126362","cwes":["CWE-79"],"description":"Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0"}],"modifiedAt":1794523503571,"publishedAt":1794522559505,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/withastro/astro/security/advisories/GHSA-f4j9-crrj-867q"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/withastro/astro/commit/5e476365378e41aa2745d003b2383d02008d7b44"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/withastro/astro/releases/tag/@astrojs/svelte@9.1.2"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-f4j9-crrj-867q"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-f4j9-crrj-867q"}],"remediation":[{"kind":"fix","source":"OSV GHSA-f4j9-crrj-867q","text":"@astrojs/svelte (npm): OSV reports a fixed version 9.1.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-f4j9-crrj-867q"}],"revision":"4028f1c0687481f3724cc5fa36e14f71d224831fc524917b65d4877fde576e7c","sources":[{"modifiedAt":1794522559505,"name":"CNA: GitHub_M","retrievedAt":1794524929079,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126362"},{"modifiedAt":1794523503571,"name":"OSV / GitHub Security Advisories","retrievedAt":1794524929740,"url":"https://osv.dev/vulnerability/GHSA-f4j9-crrj-867q"}],"ssvc":null,"status":"published","title":"Astro: Reflected XSS via unescaped slot names in @astrojs/svelte","updatedAt":1794524929740}