Skip to content
OpenAdvisories

Package · npm

@astrojs/svelte

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.3
    CVE-2026-126362

    Astro: Reflected XSS via unescaped slot names in @astrojs/svelte

    Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote co…

    withastro astro @astrojs/svelte npm