, , or and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.","datePublished":"2026-04-24T17:16:21.083","license":"https://creativecommons.org/publicdomain/zero/1.0/","dcterms:source":"https://nvd.nist.gov/vuln/detail/CVE-2026-41067","prov:wasDerivedFrom":["https://nvd.nist.gov/vuln/detail/CVE-2026-41067"],"publisher":{"@type":"Organization","@id":"https://api.ai-analytics.org/#org","name":"AI Analytics","url":"https://api.ai-analytics.org"},"sourceOrganization":{"@type":"GovernmentOrganization","name":"NIST National Vulnerability Database","url":"https://nvd.nist.gov/"},"mainEntity":{"@type":"Thing","identifier":"CVE-2026-41067","additionalType":"Vulnerability","score":6.1,"severity":"MEDIUM"},"keywords":["CWE-79"]}
CVE-2026-41067
Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.
CWE codes
CWE-79
Affected products
astro:astro
Sources