Skip to content

CVE-2026-50146

is CVE-2026-50146real, exploitable, or a false positive? Here's the community verdict.

☆ Watch
High · CVSS 7.1EPSS 0.2%CWE-80

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.

References

NVD MITRE CVE.org

Published

Embed this verdict
TruePositive verdict for CVE-2026-50146
Markdown
[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2026-50146/badge.svg)](https://www.truepositive.app/cve/CVE-2026-50146)
HTML
<a href="https://www.truepositive.app/cve/CVE-2026-50146"><img src="https://www.truepositive.app/cve/CVE-2026-50146/badge.svg" alt="TruePositive verdict for CVE-2026-50146"></a>

Live badge that updates automatically as the community verdict changes.

Community ground truth

In your experience, is this finding real and exploitable?

0 verdicts
Not a real issue

No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.

Field notes & remediation

Verdicts are the quick signal. Notes are the evidence and fixes behind them.

No notes yet. Be the first to share what you saw, or a fix that worked.

    Add a field note or remediationoptional
    Note type

    What are you adding?

    Markdown supported · minimum 20 characters.

    Related CVEs

    Same weakness: CWE-80.