CVE-2026-59729

{
  "id": "CVE-2026-59729",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-27T20:16:40.303",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing \"' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context. This issue has been fixed in version 7.0.6."
    },
    {
      "lang": "es",
      "value": "Astro es un framework web para sitios web basados en contenido. Las versiones anteriores a la 7.0.6 son vulnerables a XSS a través de nombres de atributos de propagación sin escapar en renderHTMLElement. La corrección para CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) añadió una protección INVALID_ATTR_NAME_CHAR a addAttribute() para que los nombres de atributos de propiedades de propagación que contengan ’ >/= o espacios en blanco sean descartados. Una segunda ruta de renderizado de atributos, renderHTMLElement() en packages/astro/src/runtime/server/render/dom.ts, tiene su propio bucle de atributos en línea que no pasa por addAttribute() y no fue actualizada. Interpola el nombre del atributo sin escapar y solo escapa el valor, por lo que las claves de propiedades no confiables propagadas a un componente de subclase de HTMLElement nativo aún pueden salirse del contexto del atributo. Este problema ha sido corregido en la versión 7.0.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "withastro",
          "product": "astro",
          "versions": [
            {
              "version": "< 7.0.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T13:48:15.250062Z",
          "id": "CVE-2026-59729",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/withastro/astro/pull/17251",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/withastro/astro/releases/tag/[email protected]",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}