Astro: Arbitrary CSS injection in Astro View Transitions

影響: npm:astro >= 7.1.0, <= 7.3.2 → 7.3.3

Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page. The injected content remains inside the generated

在 GitHub Advisory Database 阅读

2026/10/23 01:29，GitHub Advisory Database 发布了“Astro: Arbitrary CSS injection in Astro View Transitions”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：JavaScript / Node.js。CVE：CVE-2026-114127。