{"action":"Upgrade astro to 6.1.6 or later.","affected":[{"fixed":"6.1.6","introduced":"0"}],"component":"astro","cve_ids":["CVE-2026-41067"],"ecosystem":"npm","epss":0.00269,"exploited":false,"fixed_versions":["6.1.6"],"ghsa_id":"GHSA-j687-52p2-xcff","id":"tcs_01M5KFX5HBNC5PATTS66G0KB4E","modified_at":"2026-05-05T16:07:54.660860Z","published_at":"2026-04-21T20:39:49Z","references":["https://osv.dev/vulnerability/GHSA-j687-52p2-xcff","https://github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff","https://nvd.nist.gov/vuln/detail/CVE-2026-41067","https://github.com/withastro/astro","https://github.com/withastro/astro/releases/tag/astro@6.1.6"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-j687-52p2-xcff","url":"https://osv.dev/vulnerability/GHSA-j687-52p2-xcff"}],"summary":"Astro: XSS in define:vars via incomplete </script> tag sanitization"}