CVE-2026-73422
CVE-2026-73422: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh8.1
High [CVE-2026-73422] Arbitrary code execution via unescaped View Transition animation properties
CVE-2026-73422Source published Source updated
Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition…
- Affected products in this advisory
- Red Hat OpenShift AI (RHOAI)
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- 7.1.0
- Mitigation guidance
- Sanitize and validate all user-supplied inputs before assigning them to View Transition animation properties in dynamic routes, or temporarily disable server-side View Transitions for routes processing untrusted request parameters.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.