Astro: XSS via Unescaped Attribute Names in Spread Props
Date: 2026-06
Affected: npm/astro
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-54298
CWE: CWE-79
CVSS: 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)

## Summary The `spreadAttributes` function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to `addAttribute`, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax `{...props}` on an HTML element and the object keys come from an untrusted source (API, CMS, URL parameters), an attacker can inject arbitrary HTML attributes including event handlers like `onmousemove`, `onclick`, or break out of the attribute context entirely to inject new elements. ## Details The vulnerable function is [`addAttribute`](https://github.com/withastro/astro/blob/main/packages/astro/src/runtime/server/render/util.ts#L81-L141) at `packages/astro/src/runtime/server/render/util.ts:81-141`: ```javascript export function addAttribute(value: any, key: string, shouldEscape = true, tagName = '') { if (value == null) { return ''; } return markHTMLString(` ${key}="${toAttributeString(value, shouldEscape)}"`); // key interpolated not escaped } ``` This function is called from [`spreadAttributes`](https://github.com/withastro/astro/blob/main/packages/astro/src/runtime/server/index.ts#L91-L92) at `packages/astro/src/runtime/server/index.ts:91-92`: ```javascript for (const [key, value] of Object.entries(values)) { output += addAttribute(value, key, true, _name); } ``` The `toAttributeString` function escapes the attribute value, but the attribute name `key` is never validated or esc


Mitigations:

Architectural layers (MAESTRO):