Astro: XSS in define:vars via incomplete </script> tag sanitization

Description

The defineScriptVars function in Astro’s server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.1.6
• Patched version(s): 6.1.6

References

• GHSA-j687-52p2-xcff
• CVE-2026-41067
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag - CVE-2026-30830
• ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context - CVE-2026-33889
• jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation - CVE-2026-4599
• PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - CVE-2026-41305

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

astro