CVE-2026-59727

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.

We have discovered 24,608 live websites that are affected by CVE-2026-59727.

Run a Free Instant Scan

Affected Software

Product	Astro
Category	Static Site Generator
Vulnerable Domains	24,608 live websites (93% of Astro install base)
Vulnerable Versions	from 3.10 through 7.0.4
Vulnerable Versions Count	313 versions ( 67% of all versions)