CVE-2026-126363: Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js

The @astrojs/solid-js renderer wraps named slot content passed to Solid components in an <astro-slot> element, and writes the slot name into its name attribute without HTML escaping. A slot name containing " could end the attribute and inject arbitrary HTML into the page.

For example, a page that takes a slot name from the request:

---
import Tabs from '../components/Tabs.jsx';
const tab = Astro.url.searchParams.get('tab');
---
<Tabs client:load active={tab}><div slot={tab}>…</div></Tabs>

rendered with a Solid component that renders a slot by name:

export default function Tabs(props) {
return <div>{props[props.active]}</div>;
}

would output a tab value such as x"><img src=x onerror=alert(1)> as live HTML.