CVE-2026-114127: CSS injection in Astro View Transitions
Summary
CVE-2026-114127: Attacker-controlled animation values can inject CSS into a rendered page, allowing UI content to be restyled, concealed, or misrepresented. Affects astro versions >= 7.1.0, < 7.3.3. Fixed in 7.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a JavaScript web framework in the npm ecosystem. It provides tools for building websites and supports View Transitions, including server-rendered pages. Astro’s server-side View Transition CSS generator serializes animation properties into stylesheets. Applications can supply animation values when configuring transitions, including values derived from request data.
Vulnerability Detail
This CSS injection vulnerability can let an attacker alter the appearance of an affected application’s rendered page. Astro’s server-side View Transition CSS generator serialized string animation properties without encoding CSS declaration delimiters. When an application passes attacker-controlled data into properties such as duration, the value can escape its intended declaration and add CSS rules. The injected content remains inside the generated style element; the issue does not enable HTML or JavaScript injection. Exploitation requires untrusted data to reach a transition animation value.
How To Fix
Latest published version: 7.4.2 as of 23 Oct 2026
npm install astro@7.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.3.3
This is the first release that contains the fix.
npm install astro@7.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Documented workaround: Astro applications should avoid passing untrusted or request-derived values into View Transition animation properties. Validate dynamic values against the expected CSS grammar; for duration and delay, use finite numbers or strictly validated CSS time values.
Documented mitigation:
ts
out +=
Conclusion
Bottom line: upgrade Astro to the minimum fixed version, 7.3.3. Applications that cannot upgrade should keep untrusted and request-derived data out of View Transition animation properties and validate any dynamic values against the expected CSS grammar. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for astro →
FAQ
Astro versions 7.1.0 through 7.3.2 are affected by CVE-2026-114127.
CVE-2026-114127 lets attackers inject CSS into Astro-rendered pages when untrusted data reaches a transition animation value, potentially misrepresenting the UI.
Upgrade Astro to the minimum fixed version, 7.3.3, to address CVE-2026-114127.
Avoid passing untrusted or request-derived values into Astro View Transition animation properties; validate dynamic values against the expected CSS grammar.
Check package-lock.json for Astro and compare its installed version with the affected range. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for astro.
