- The GitHub Advisory Database describes a flaw in Astro's View Transitions that lets untrusted input add CSS to a page. It is patched in [email protected].
- It applies only when an application passes untrusted data into a transition animation value. The advisory calls that pattern uncommon and shows no JavaScript execution.
- Upgrade to [email protected] and check whether any page feeds request-derived data into transition settings.
An escape that covered one language and missed another
Making a page safe means guarding against more than one kind of dangerous character. A fix for one layer can leave the next layer open. A flaw in Astro's page-transition code shows how. The GitHub Advisory Database published the advisory on October 22.
The lesson is simple. An escape built for HTML does not protect the CSS inside it. Each language that data passes through has its own special characters. Each needs its own check.
How the flaw works
Astro is a web framework. Its View Transitions feature animates the move from one page to the next. On the server, Astro writes a style block that holds the animation rules.
A function called stringifyAnimations() gathers the animation values. A second one, addAnimationProperty(), puts each value into a CSS declaration. Text values were converted with toString() and dropped in unchanged.
The finished stylesheet then goes through escapeStyleText(). That step escapes the "<" character. So injected text cannot close the style block or add HTML or scripts.
CSS has its own punctuation, though. The advisory says the characters ";", "{" and "}" still worked. A value containing them could end its declaration and its rule. It could then add a new rule chosen by the attacker.
The affected code was one shared serializer. So every text-based animation property in a custom transition, from timing to animation names, took the same path.
This belongs to the same family as SQL injection. Data meant to stay data gets read as instructions.
What an attacker can and cannot do
The attack has a firm precondition. An app must take content from a visitor or a request and feed it straight into an animation setting. The advisory calls this an uncommon pattern. Apps that use fixed or trusted values are unaffected.
The advisory gives reproduction steps using [email protected] on a page rendered on demand. In Chromium, the target element's computed styles changed to rgb(1, 2, 3) and 37px. This held in a production standalone server build, not only in the development server.
The advisory also states the limits. Its demonstration shows no script running and no HTML injected. It shows no break across site origins and no access to server-only data. On its own, the flaw gives no view of cookies, server-side values, page text or responses from other sites.
Injected CSS can still change how a page looks. The advisory says it can restyle or hide content, move existing controls, or add text that was never there. In some apps, CSS tricks may also reveal data that already sits in selectable page attributes. How far that goes varies from app to app. The advisory links it to what the page contains and how its Content Security Policy is set. That policy is a set of browser rules limiting what a page may load.
For a business, a page that looks different from what was built is a trust problem, even without code execution. A customer who sees a moved button or a missing label cannot tell the page was altered.
Where this sits among Astro advisories
The advisory points to an earlier issue, GHSA-4g3v-8h47-v7g6 / CVE-2026-73422. It covers versions through 7.0.9. Its impact was stronger. It could escape the style element and inject HTML or JavaScript. The advisory also links NVD entry CVE-2026-114127 for the new issue.
WebPulse's NVD data, refreshed on October 23, 2026, lists 20 CVEs for Astro in total. It counts 14 of them in the last 12 months. None is in the CISA Known Exploited Vulnerabilities catalog, and none is rated critical.
Read that as a signal about upkeep, not about severity. A team running Astro needs a steady routine for taking updates. A yearly review would not match a flow of 14 disclosures in 12 months.
What to ask your team
The fix is in [email protected]. The patch now neutralizes the characters that end a CSS declaration whenever it writes out an animation value. Normal CSS functions such as calc() and var(), and ordinary strings, still work. The change is withastro/astro#17970.
Put four questions to the team that owns your Astro sites.
First, which version do we run? Is it 7.3.3 or later? Second, does any page feed a query string, cookie or profile field into a transition setting? Third, where dynamic values are needed, are they checked first? For timing values, the advisory points to plain numbers or time values checked against strict rules. Fourth, what does our Content Security Policy allow? The advisory ties data exposure to it.
A team may well find it never passed user data into a transition. Confirm that answer rather than assume it. Escaping is not one act. It is one check for each language the data passes through.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: GitHub Advisory Database.
