CVE WATCH / VULNERABILITY DETAIL
CVE-2026-126361
UNKNOWNCVSS 0NVD feed
Published 13 November 2026 · tracked since 13 November 2026
Description
Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-110199 MEDIUM 4.8
- CVE-2026-128128 HIGH 7.5
- CVE-2026-127217 MEDIUM 6.4
- CVE-2026-127216 MEDIUM 6.5
- CVE-2026-68905 HIGH 8.2
- CVE-2026-128089 HIGH 7.5
- CVE-2026-127215 HIGH 8.1
- CVE-2026-127214 HIGH 8.5
- CVE-2026-128088 LOW 2.2
- CVE-2026-128087 LOW 3.7