https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T21:34:25.774836+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-50146 CVE-2026-50146 — Astro: Reflected XSS via unescaped slot name 2026-10-08T21:34:25.789794+00:00

Affected: withastro astro

Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.