Detections
Analytics
SCA: security update for astro (GHSA-f48w-9m4c-m7f5)
medium Tenable Cloud Security Plugin ID 445908
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS
through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-
wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names
containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in
packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go
through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes
the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out
of the attribute context. This issue has been fixed in version 7.0.6. (CVE-2026-59729)
Solution
Update the astro library and its related packages to version 7.0.6 or later.See Also
Plugin Details
Severity: Medium
ID: 445908
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 8/13/2026
Updated: 8/13/2026
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.62
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2026-59729
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.1
Threat Score: 1.2
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 7/20/2026
Vulnerability Publication Date: 7/20/2026
Reference Information
CVE: CVE-2026-59729
cwe: CWE-79