CVE-2026-50146CWE-80

Astro: Reflected XSS via unescaped slot name

High · published June 22, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00268 · 18.0th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-06-22T17:31Z
EPSS history
Timeline
  • 22 JUN 17:31Z
    Astro: Reflected XSS via unescaped slot name
    cvelistv5