Astro: Arbitrary CSS injection in Astro View Transitions

影響: npm:astro >= 7.1.0, <= 7.3.2 → 7.3.3

Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page. The injected content remains inside the generated

GitHub Advisory Database에서 읽기

2026. 10. 23. 오전 01:29, GitHub Advisory Database에서 "Astro: Arbitrary CSS injection in Astro View Transitions"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-114127.