{"id":"ghsa-ghsa-98hj-9722-w3j8","seq":309570,"kind":"advisory","title":"Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering","url":"https://github.com/advisories/GHSA-98hj-9722-w3j8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-98hj-9722-w3j8","summary":"影響: npm:astro < 7.3.2 → 7.3.2\nAstro's JSX and MDX rendering pipeline treated string children of , an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escaped dynamic strings automatically. This behavior was limited to passed to was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script. The fix preserves raw rendering for literal script and style content while escaping dynami…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-114128"],"tags":["GHSA-98hj-9722-w3j8","astro"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:30:26.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}