CVE-2026-59729

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59729", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-06T15:34:16.917Z", "datePublished": "2026-07-27T19:38:40.372Z", "dateUpdated": "2026-07-28T13:48:46.640Z"}, "containers": {"cna": {"title": "Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5"}, {"name": "https://github.com/withastro/astro/pull/17251", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/pull/17251"}, {"name": "https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d"}, {"name": "https://github.com/withastro/astro/releases/tag/astro@7.0.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/releases/tag/astro@7.0.6"}], "affected": [{"vendor": "withastro", "product": "astro", "versions": [{"version": "< 7.0.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-27T19:38:40.372Z"}, "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing \"' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6."}], "source": {"advisory": "GHSA-f48w-9m4c-m7f5", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T13:48:15.250062Z", "id": "CVE-2026-59729", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T13:48:46.640Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59729", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T13:48:15.250062Z"}}}], "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T13:48:33.738Z"}}], "cna": {"title": "Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)", "source": {"advisory": "GHSA-f48w-9m4c-m7f5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "withastro", "product": "astro", "versions": [{"status": "affected", "version": "< 7.0.6"}]}], "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5", "name": "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/withastro/astro/pull/17251", "name": "https://github.com/withastro/astro/pull/17251", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d", "name": "https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/withastro/astro/releases/tag/astro@7.0.6", "name": "https://github.com/withastro/astro/releases/tag/astro@7.0.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing \"' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-27T19:38:40.372Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59729", "state": "PUBLISHED", "dateUpdated": "2026-07-28T13:48:46.640Z", "dateReserved": "2026-07-06T15:34:16.917Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-27T19:38:40.372Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "astro", "vendor": "withastro", "versions": [{"status": "affected", "version": "< 7.0.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing \"' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6."}, {"lang": "es", "value": "Astro es un framework web para sitios web basados en contenido. Las versiones anteriores a la 7.0.6 son vulnerables a XSS a trav\u00e9s de nombres de atributos de propagaci\u00f3n sin escapar en renderHTMLElement. La correcci\u00f3n para CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) a\u00f1adi\u00f3 una protecci\u00f3n INVALID_ATTR_NAME_CHAR a addAttribute() para que los nombres de atributos de propiedades de propagaci\u00f3n que contengan \u2019 >/= o espacios en blanco sean descartados. Una segunda ruta de renderizado de atributos, renderHTMLElement() en packages/astro/src/runtime/server/render/dom.ts, tiene su propio bucle de atributos en l\u00ednea que no pasa por addAttribute() y no fue actualizada. Interpola el nombre del atributo sin escapar y solo escapa el valor, por lo que las claves de propiedades no confiables propagadas a un componente de subclase de HTMLElement nativo a\u00fan pueden salirse del contexto del atributo. Este problema ha sido corregido en la versi\u00f3n 7.0.6."}], "id": "CVE-2026-59729", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59729", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T13:48:15.250062Z", "version": "2.0.3"}}]}, "published": "2026-07-27T20:16:40.303", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/pull/17251"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/releases/tag/astro@7.0.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "astro", "source": "cna", "vendor": "withastro"}, "product": "astro", "vendor": "withastro"}], "created": "2026-07-28T03:15:07.797719+00:00", "updated": "2026-08-03T17:00:06.126395+00:00", "vendors": ["withastro", "withastro$PRODUCT$astro"]}