npm/astro CVE-2026-114127: low 2.3
Astro: Arbitrary CSS injection in Astro View Transitions
Action: Upgrade astro to 7.3.3 or later.
npm i astro@7.3.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.1.0 | 7.3.3 | - |
Fixed versions
| 7.3.3 |
Sources
- osv: GHSA-mpr7-6m5w-76rw
- nvd: CVE-2026-114127
- https://github.com/withastro/astro/security/advisories/GHSA-mpr7-6m5w-76rw
- https://github.com/withastro/astro/pull/17970
- https://github.com/withastro/astro/commit/0b4dc3a211910b589d3805ab4dfedf11b0e712bb
- https://github.com/withastro/astro
- https://github.com/withastro/astro/releases/tag/astro@7.3.3
CVE-2026-114127 · published · modified · JSON