---
id: CVE-2026-73422
title: Astro is a web framework for content-driven websites
summary: >-
  Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0,
  Astro's server-side View Transition CSS generator interpolates animation
  properties into an inline style element without escaping them for CSS and HTML
  context…
severity: none
cwe:
  - CWE-79
published: '2026-08-12'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:02:22.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73422'
references:
  - url: >-
      https://github.com/withastro/astro/commit/092da560eea77ee63a3e2c583c80d8238544e42b
    label: security-advisories@github.com
  - url: 'https://github.com/withastro/astro/pull/17393'
    label: security-advisories@github.com
  - url: 'https://github.com/withastro/astro/releases/tag/astro@7.1.0'
    label: security-advisories@github.com
  - url: 'https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6'
    label: security-advisories@github.com
  - url: 'https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00547
epssPercentile: 0.43401
ingestedAt: '2026-08-15T22:29:51.860Z'
---

## Overview

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition and can execute arbitrary JavaScript in the affected application's origin, allowing access to sensitive page data and authenticated actions available to the victim. This issue is fixed in version 7.1.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.