← Database

CVE-2026-41067

MEDIUM CVSS: 6.1 Published: 2026-04-24 Modified: 2026-06-17

Description

Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline , , or and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.

Affected Platforms

Astro Astro

Weakness Type

CWE-79

References