{"affected":[{"product":"astro","source":"CNA: GitHub_M","vendor":"withastro","versions":[{"status":"affected","version":">= 0.2.0, < 7.1.2"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@astrojs/solid-js","product":"@astrojs/solid-js","source":"OSV GHSA-jmv2-qgxf-f995","vendor":"","versions":[{"events":[{"introduced":"0.2.0"},{"fixed":"7.1.2"}],"lessThan":"7.1.2","status":"affected","version":"0.2.0","versionType":"semver"}]}],"cveId":"CVE-2026-126363","cwes":["CWE-79"],"description":"Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Solid component using a client:* directive and dynamic access to the attacker-chosen slot property; a component that did not render that slot emitted only escaped fallback content. This issue is fixed in version 7.1.2.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0"}],"modifiedAt":1794523504210,"publishedAt":1794522706889,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/withastro/astro/security/advisories/GHSA-jmv2-qgxf-f995"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/withastro/astro/commit/290b196ddb48de11783ff128e2b7272c61490a20"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/withastro/astro/releases/tag/@astrojs/solid-js@7.1.2"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-jmv2-qgxf-f995"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-jmv2-qgxf-f995"}],"remediation":[{"kind":"fix","source":"OSV GHSA-jmv2-qgxf-f995","text":"@astrojs/solid-js (npm): OSV reports a fixed version 7.1.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-jmv2-qgxf-f995"}],"revision":"cbab3d0a738f1517ae66c5cf77ff3e0ee9a7ca5ab0e0528cdbf4c2f23e316362","sources":[{"modifiedAt":1794522706889,"name":"CNA: GitHub_M","retrievedAt":1794524930234,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126363"},{"modifiedAt":1794523504210,"name":"OSV / GitHub Security Advisories","retrievedAt":1794524930900,"url":"https://osv.dev/vulnerability/GHSA-jmv2-qgxf-f995"}],"ssvc":null,"status":"published","title":"Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js","updatedAt":1794524930900}