Astro: Reflected XSS via unescaped slot names in @astrojs/svelte
The @astrojs/svelte renderer wraps slotted content passed to Svelte components in an <astro-slot> element, and writes the slot name into its name attribute without HTML escaping. A slot name containing " could end the attribute and inject arbitrary HTML into the page. For example, a page that takes a slot name from the request: — import Tabs from '../components/Tabs.svelte'; const tab = Astro.url.searchParams.get('tab'); — <Tabs client:load active={tab}><div slot={tab}>…</div></Tabs> rendered with …