Skip to content
OpenAdvisories

Package · npm

@astrojs/solid-js

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.3
    CVE-2026-126363

    Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js

    Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote…

    withastro astro @astrojs/solid-js npm