Astro: XSS via Unescaped Attribute Names in Spread Props

Vulnerability

The spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without escaping. The vulnerable code is in packages/astro/src/runtime/server/render/util.ts (lines 81–141) and packages/astro/src/runtime/server/index.ts (lines 91–92). When a developer uses the spread syntax {...props} on an HTML element and the object keys come from an untrusted source (API, CMS, URL parameters), an attacker can inject arbitrary HTML attributes. Affected versions are those that include the unpatched spreadAttributes implementation; no specific version range is provided in the available references [1][2].

Exploitation

An attacker needs to control the keys of the object spread onto an HTML element. For example, an SSR page that parses Astro.url.searchParams into a JSON object and spreads it onto a ` allows the attacker to supply a malicious query string such as ?props={"onmouseover":"alert(1)"}. The Object.entries() loop passes each key directly to addAttribute, which renders the key unescaped. A crafted key like " onclick="alert(1)` can break out of the attribute context and inject event handlers or new HTML elements [1][2].

Impact

Successful exploitation leads to cross-site scripting (XSS). An attacker can inject arbitrary HTML attributes, including event handlers like onmouseover, onclick, or completely break the attribute context to introduce new script tags or elements. This results in arbitrary JavaScript execution in the context of the user's session, potentially leading to data theft, session hijacking, or defacement [1][2].

Mitigation

No fixed version is explicitly stated in the available references. As a workaround, developers should avoid spreading user-controlled object keys directly onto HTML elements. Keys should be sanitized or validated before being passed to the component. Server-side rendering pages that accept untrusted input via JSON.parse(Astro.url.searchParams.get('props')) should not use the spread syntax without filtering. The Astro team has acknowledged the issue in the GitHub advisory [1][2]; users are advised to monitor for a patched release.