- GitHub's advisory says Astro before 7.4.5 could turn a crafted tag name into live HTML with a script handler, but only where untrusted input chose the tag.
- The flaw is a filter that missed the slash character. The advisory says even a correct filter would leave elements such as script and iframe selectable.
- Teams should upgrade to 7.4.5 or later and map any user-influenced element choice to a fixed list of known tags.
A filter only blocks what its author thought of
Input filtering is often treated as a safety net: strip the bad characters and the rest is fine. A GitHub Advisory Database entry for Astro, published November 13, 2026, shows the limit of that habit. The filter did what it was built to do. It simply had no rule for one character.
The advisory's broader point matters more than the bug. Even a flawless filter, it says, would not make outside input an acceptable way to pick an element name. Script and iframe would still be available choices. The lesson here is that the control worth paying for is a fixed list of allowed choices, not a longer list of banned characters.
How the flaw worked
Astro is a web framework for building content sites. Developers can write a dynamic tag: a variable that holds an element name and is used in a template like a normal tag. When that variable holds a string, Astro writes the string into the page as a raw HTML element name.
According to the advisory, Astro stripped characters from that name to stop attribute injection. The filter had no rule for the slash. HTML parsers read a slash inside a tag as a separator between attributes.
That gap let one string do two jobs. The advisory's example, img/src/onerror=alert(1), came out as an image element with an onerror attribute. That attribute holds code that runs when the image fails to load.
MDX is a format that mixes Markdown with components. The advisory says the JSX renderer behind it applied no filtering to string tag names. Its example is a request parameter called as, set to the same string, which produced live markup.
Who is exposed, and who is not
The scope is narrow, and the advisory says so. The outcome is cross-site scripting, where injected script runs in a visitor's browser. It can be reflected or stored. It applies only where an application builds an element name, wholly or partly, from untrusted input. Examples are a request parameter or an uncontrolled field in a content management system. The advisory states that Astro itself does not derive element names from request data.
So a typical Astro site is not affected by default. The exposure sits in custom code where a developer let a URL or an editor's field decide which tag to draw. That is a plausible shortcut when building flexible layouts, for instance a heading component whose level comes from content.
WebPulse's September 2026 scan of the Tranco top 10,000 domains found a platform on 2,491 sites. Astro was detected on 81 of them, or 3.3% of detected sites. That shows Astro is in use among highly ranked sites. It says nothing about how many use dynamic tags with outside input.
WebPulse's NIST NVD data lists 20 CVEs for Astro in total, 11 of them in the last 12 months, and 0 entries in CISA KEV. No source here reports exploitation of this issue.
What the fix changes
The advisory says the fix ships in Astro 7.4.5. In .astro dynamic tags, JSX and MDX, a string tag name is now cut down to its leading valid element name. Anything after that point, such as a slash or an equals sign, is dropped and cannot alter the markup.
Astro also now raises an error when a string does not begin with a valid element name. That is a trade-off. A page that once rendered oddly may now fail outright. Teams should test content-driven templates after upgrading. The advisory links to NVD entry CVE-2026-126361 and to the [email protected] release notes.
Questions for your team
Ask the web team to upgrade Astro to 7.4.5 or later. Then ask three narrower questions.
First, does any template build an element name from a URL parameter, a form value or a CMS field? Second, if so, is that input mapped to a short fixed list of tags, as the advisory recommends? Third, who owns the content fields editors can change, and are they treated as trusted?
The advisory's own interim advice, for teams not yet upgraded, is to avoid untrusted element names or map them to known tags. A patch fixes one flaw. A fixed list removes the whole category.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: GitHub Advisory Database.
