CVEFinder.io

CVE-2026-45028

🔶 medium
🔍 Scan for this CVE
Summary

Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props (p) value as another component's slots (s) value, or vice versa. Since slots contain raw unescaped HTML while props may contain user-controlled values, this could lead to XSS in applications. Thi

Description

Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props (p) value as another component's slots (s) value, or vice versa. Since slots contain raw unescaped HTML while props may contain user-controlled values, this could lead to XSS in applications. This occurs when the application uses server islands, two different server island components share the same key name for a prop and a slot, and an attacker has full control over the value of the overlapping prop (requires a dynamically rendered page). This vulnerability is fixed in 6.1.10.

CVSS Score
6.1
Medium
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-13
First Seen: 2026-05-17
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 38.8% of all 329,456 vulnerabilities in our database.

#201,538
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 14, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-05-14
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)
CWE-323 CWE-79

📦 Affected Products 1

Vendor Product Status Affected Versions
astro astro Affected
< 6.1.10

🔗 References 3

https://github.com/withastro/astro/commit/3d82220a15...
Patch
https://github.com/withastro/astro/pull/16457
Issue Tracking Patch
https://github.com/withastro/astro/security/advisori...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-50146 ⚠️ high 7.1 0.2 Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content i... 2026-06-22
CVE-2026-54298 🔶 medium 4.2 0.2 Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterat... 2026-06-22
CVE-2026-54299 ⚠️ high 7.5 0.2 Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const p... 2026-06-22
CVE-2026-41067 🔶 medium 6.1 0.0 Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a... 2026-04-24
CVE-2026-33769 🔶 medium 5.3 0.0 Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path... 2026-03-24
CVE-2025-66202 🔶 medium 6.5 0.3 Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated a... 2025-12-09
These CVEs affect the same products