CVE-2026-73422

The CVSS score of 5.3 for CVE-2026-73422 fundamentally misrepresents the actual severity. This is a server-side JavaScript execution vector, not a theoretical HTML injection. The vulnerability exists in Astro's SSR layer where attacker-controlled data reaching a View Transition animation definition gets concatenated into HTML output without CSS-context escaping—a mixed-context injection that standard templating escaping doesn't address. The CVSS weighting treats the prerequisite of 'server-rendered route' as a mitigating constraint, but that's precisely the attack surface, not a limitation on it. Successful exploitation grants full origin access and authenticated action capability through the victim's browser context. The fix in version 7.1.0 targeted only the transition.ts file, confirming this was a surgical bug introduced by specific View Transition code rather than a longstanding architectural flaw. However, this pattern has direct lineage through React's dangerouslySetInnerHTML, Angular's contextual escaping bypass, and early Node.js template engines—a documented evolutionary dead end that keeps recurring because each generation of framework developers independently rediscovers the same constraint: when your framework handles CSS-in-JS server-side for progressive enhancement, you're requiring a single code path to produce values safe in two incompatible escaping contexts simultaneously. What should concern you most is the blast radius topology. Astro's target market—content-driven sites, marketing frontends, documentation hubs—frequently runs in hybrid mode: static for public pages, SSR for authenticated dashboards. This is exactly where the vulnerability sits. If your Astro deployment exposes any authenticated functionality on the same origin that handles View Transitions, the exploitation path leads from public defacement to session hijacking in a single chain. The EPSS score of 0.00311 likely reflects that the specific routing architecture required is uncommon in practice—but that changes post-disclosure. The real severity isn't captured by CVSS's point-in-time scoring: every day of delay in patching a server-side JS execution vector that targets authenticated-action contexts is compounding exposure, not routine patch latency. Upgrade to 7.1.0 immediately, and audit any code paths that interpolate user data into HTML output for View Transitions or similar animation APIs—the cognitive load trap that created this vulnerability exists elsewhere in the SSR pipeline too.

Reviewed through automated stages and approved by a human before publication.