PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50146 withastro CVE debrief

CVE-2026-50146 is a reflected XSS vulnerability in the Astro web framework. The vulnerability occurs when a component uses a client:* directive, allowing an attacker to inject arbitrary HTML by breaking out of the attribute context. This issue was fixed in Astro version 6.3.3. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity. The CVE was published on June 22, 2026, and modified on June 23, 2026.

Vendor
withastro
Product
astro
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-23
Advisory published
2026-06-22
Advisory updated
2026-06-23

Who should care

Developers and administrators using Astro web framework versions prior to 6.3.3 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 6.3.3 or later and reviewing their applications for potential vulnerabilities. Additionally, users who have applications that use client:* directives should be cautious of potential XSS attacks.

Technical summary

The vulnerability occurs in the Astro web framework's handling of client:* directives. When a component uses such a directive, Astro inserts named slot content into a data-astro-template attribute without proper HTML escaping of the slot name. This allows an attacker to inject arbitrary HTML, potentially leading to reflected XSS attacks during Server-Side Rendering (SSR). The issue was addressed in Astro version 6.3.3 by properly escaping the slot names.

Defensive priority

High priority should be given to upgrading Astro to version 6.3.3 or later. Additionally, developers should review their applications for potential vulnerabilities, especially those using client:* directives, and implement compensating controls such as input validation and output encoding.

Recommended defensive actions

  • Upgrade Astro to version 6.3.3 or later
  • Review applications for potential vulnerabilities, especially those using client:* directives
  • Implement compensating controls such as input validation and output encoding
  • Monitor applications for potential XSS attacks
  • Perform regular security audits and penetration testing

Evidence notes

The CVE-2026-50146 vulnerability was identified in the Astro web framework. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity. The issue was fixed in Astro version 6.3.3. Limited information is available about potential exploits or attacks in the wild.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50146 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50146

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50146 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50146

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.