Astro framework’s server‑side View Transition CSS generator does not isolate string animation properties, allowing attacker‑controlled data such as duration, delay, or animation names to close a CSS declaration and add additional CSS rules. The injected styles cannot terminate the style element or insert JavaScript, but they can hide or reposition content, add visible text, and misrepresent the interface. Because some applications expose data from selectable DOM attributes through conditional resource loads, the injected CSS could inadvertently leak information.

Astro (withastro:astro) versions from 7.1.0 up to, but not including, 7.3.3 are vulnerable. The issue was remediated in release 7.3.3, so any deployment running 7.3.3 or newer is considered fixed.

The CVSS score of 2.3 reflects the modest impact and the absence of a direct code execution path. The EPSS score is <1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers must supply crafted animation property values—typically through user input forwarded to the view transition generator—to manipulate the UI of every visitor to the affected site. The risk is therefore limited to interface tampering and possible data exposure rather than remote code execution.