Astro, a popular web framework, interpolates animation properties supplied to View Transition CSS directly into an inline style element without proper escaping for CSS and HTML contexts. An attacker who controls a View Transition animation value, such as duration, can break out of the intended CSS and inject arbitrary HTML or JavaScript. When such a route is rendered server‑side or on‑demand, the injected script runs with the permissions of the affected application, enabling the theft of sensitive data, authentication credentials, and the execution of malicious authenticated actions in the victim’s context. The weakness is a Common Weakness Enumeration CWE‑79, a reflected XSS flaw.

The vulnerability affects the Astro web framework from version 2.9.0 through 7.0.x. The issue was fixed in Astro release 7.1.0. The framework is used by developers building content‑driven websites and includes a server‑side View Transition CSS generator that is susceptible when animation values are supplied without sanitization.

The CVSS score of 5.3 indicates a medium severity vulnerability. EPSS is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires control over a route that passes attacker‑crafted animation values to the server, which is feasible for attackers who can influence user input or route parameters. Once the server renders the unescaped animation string, the client can execute arbitrary JavaScript on the application’s origin. The attack vector is thus an on‑demand or server‑rendered route providing attacker input, and the risk level is considered moderate with potential for significant impact if the application serves sensitive data.