Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js
The @astrojs/solid-js renderer wraps named slot content passed to Solid components in an <astro-slot> element, and writes the slot name into its name attribute without HTML escaping. A slot name containing " could end the attribute and inject arbitrary HTML into the page. For example, a page that takes a slot name from the request: — import Tabs from '../components/Tabs.jsx'; const tab = Astro.url.searchParams.get('tab'); — <Tabs client:load active={tab}><div slot={tab}>…</div></Tabs> rendered …