{"id":"ghsa-ghsa-mpr7-6m5w-76rw","seq":309571,"kind":"advisory","title":"Astro: Arbitrary CSS injection in Astro View Transitions","url":"https://github.com/advisories/GHSA-mpr7-6m5w-76rw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-mpr7-6m5w-76rw","summary":"影響: npm:astro >= 7.1.0, <= 7.3.2 → 7.3.3\nAstro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page. The injected content remains inside the generated","severity":"low","techs":["nodejs"],"cves":["CVE-2026-114127"],"tags":["GHSA-mpr7-6m5w-76rw","astro"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:29:28.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}