## Astro: Arbitrary CSS injection in Astro View Transitions

- 種別: advisory
- 重大度: low
- 関連技術: nodejs
- CVE: CVE-2026-114127
- 公開日時: 2026-10-22T16:29:28.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-mpr7-6m5w-76rw)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-mpr7-6m5w-76rw

影響: npm:astro >= 7.1.0, <= 7.3.2 → 7.3.3
Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page. The injected content remains inside the generated