CVE-2026-114127: Astro: Arbitrary CSS injection in Astro View Transitions

Astro’s server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page.

The injected content remains inside the generated <style> element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes < before emitting the stylesheet.