https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-05T13:54:49.159860+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-54298 fkie_cve-2026-54298 2026-10-05T13:54:49.183124+00:00

Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax {...props} on an HTML element and the object keys come from an untrusted source (API, CMS, URL parameters), an attacker can inject arbitrary HTML attributes including event handlers like onmousemove, onclick, or break out of the attribute context entirely to inject new elements. This vulnerability is fixed in 6.4.6.

 https://db.gcve.eu/vuln/ghsa-jrpj-wcv7-9fh9 GHSA-jrpj-wcv7-9fh9 — Astro: XSS via Unescaped Attribute Names in Spread Props 2026-10-05T13:54:49.183231+00:00

Affected: npm: astro

## Summary

The `spreadAttributes` function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to `addAttribute`, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax `{...props}` on an HTML element and the object keys come from an untrusted source (API, CMS, URL parameters), an attacker can inject arbitrary HTML attributes including event handlers like `onmousemove`, `onclick`, or break out of the attribute context entirely to inject new elements.

## Details

The vulnerable function is [`addAttribute`](https://github.com/withastro/astro/blob/main/packages/astro/src/runtime/server/render/util.ts#L81-L141) at `packages/astro/src/runtime/server/render/util.ts:81-141`:

```javascript export function addAttribute(value: any, key: string, shouldEscape = true, tagName = '') { if (value == null) { return ''; } return markHTMLString(` ${key}="${toAttributeString(value, shouldEscape)}"`); // key interpolated not escaped } ```

This function is called from [`spreadAttributes`](https://github.com/withastro/astro/blob/main/packages/astro/src/runtime/server/index.ts#L91-L92) at `packages/astro/src/runtime/server/index.ts:91-92`:

```javascript for (const [key, value] of Object.entries(values)) { output += addAttribute(value, key, true, _name); } ```

The `toAttributeString` function escapes the attribute value, but the attribute name `key` is never validated or es…