Astro's JSX and MDX rendering pipeline treated string children of script and style elements as trusted HTML, allowing an attacker to embed a closing script or style tag in dynamic content. This flaw permits the injection of arbitrary HTML and JavaScript, resulting in reflected or stored Cross‑Site Scripting under the application's origin. The vulnerability is limited to dynamic children rendered through the astro:jsx renderer, including MDX components, and does not affect other JSX contexts that perform automatic escaping.

The flaw affects the withastro:astro web framework, Astro, in all releases prior to version 7.3.2. Any deployment of Astro using these earlier versions is potentially vulnerable to XSS attacks that inject malicious script or style content into the rendered pages.

The CVSS score of 6.5 reflects a moderate severity with an invulnerability that can be exploited by an attacker who can supply uncontrolled data to script or style children. The EPSS score is not available, and Astro is not listed in the CISA KEV catalog, implying no known widespread exploitation yet. The likely attack vector is remote web application exploitation, where a malicious payload is delivered through user‑controlled input and reflected or persisted in the generated content.