ASTRO · GHSA-mh32-jxcr-mh9f · Package
FIX → 7.4.5
When a dynamic Astro tag resolves to a string from untrusted input, a crafted name such as img/src/onerror=alert(1) renders as an element with an injected attribute. An attacker gets cross-site scripting in pages that build element names from request data.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that use untrusted input, such as a request parameter or an uncontrolled CMS field, as all or part of an element name in a dynamic tag. Astro itself never derives element names from request data, so sites with fixed tag names are not exposed.
Not affected if fixed-tag-names, no-untrusted-tag-input
Who cares astro, cms, web-apps
npm ls astro and look for any astro version at or below 7.4.4..astro, JSX and MDX files for dynamic tags, such as <Tag /> where Tag comes from a string, and check whether that string can come from a request parameter or CMS field.Upgrade to 7.4.5
When a dynamic tag (const Tag = ...; <Tag />) resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle /. Because HTML parsers treat / inside a tag as an attribute separator, a tag name such as img/src/onerror=alert(1) was rendered as an <img> element with an onerror attribute. The JSX renderer used for MDX did not filter string tag names at all.
For example:
---
const Tag = Astro.url.searchParams.get('as') ?? 'div';
---
<Tag>hello</Tag>
rendered ?as=img/src/onerror=alert(1) as live HTML.
Reflected or stored cross-site scripting, but only in applications that use untrusted input (such as a request parameter or an uncontrolled CMS field) as all or part of an element name. Astro itself never derives element names from request data.
Applications that let content choose an element should map that input to a fixed set of known tags. Letting untrusted input choose an element name is unsafe even with a correct filter, because it can still select elements such as or .
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
astro 7.4.5 or later.scriptiframeastro <= 7.4.4.
Fixed in astro 7.4.5. String tag names in .astro dynamic tags, JSX, and MDX now render only the leading valid element name, so characters such as / or = can no longer change the generated markup. Strings that do not start with a valid element name now throw an error.
Upgrade to astro 7.4.5 or later. Before upgrading, do not use untrusted input as an element name, or map it to a fixed set of known tags.
Reported by @uttej-badwane.