CVE-2026-59727: Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applie

unknownCVE-2026-59727

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-07-27
Last updated: 2026-07-28
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59727

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-597270.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59727	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

lowGHSA-7pw4-f3q4-r2p2: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islan…ghsa

Recent advisories for Astro is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-59730: Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when t…nvd · 2026-07-27
mediumCVE-2026-59728: Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the so…nvd · 2026-07-27
unknownCVE-2026-59729: Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable t…nvd · 2026-07-27
mediumGHSA-8mv7-9c27-98vc: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware(…ghsa · 2026-07-20
mediumGHSA-f48w-9m4c-m7f5: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for …ghsa · 2026-07-20
lowGHSA-7pw4-f3q4-r2p2: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islan…ghsa · 2026-07-20