T09 · Insecure Skill Coding Practices
Error
- Location
references/astro-integration.md:170- Finding
Unsanitized CMS HTML Rendering Enables Stored Cross-Site Scripting
- Content
View full analysis
{page.title}
``` A second instance uses the same unsafe rendering pattern: ```astro {post.cover_image && ()}
{post.title}
{typeof post.author === 'object' && post.author && (By {post.author.name}
)} {new Date(post.date_created).toLocaleDateString()} ``` ### Technical Analysis Astro's `set:html` directive inserts a value as raw HTML and bypasses normal output escaping. The examples render `page.content` and `post.content` obtained from Directus without applying an allowlist-based HTML sanitizer. Although CMS content may be considered trusted in some deployments, content can also originate from editors, imports, API clients, automation flows, or compromised accounts. Any such source capable of storing HTML could inject script elements, event-handler attributes, dangerous URLs, malicious forms, or embedded active content. This network behavior is not itself covert exfiltration: retrieving content from a user-configured Directus server is necessary for the declared functionality. The vulnerability arises when the retrieved content is treated as executable markup without validation. ### Attack Path 1. An attacker obtains content-write permission through a compromised editor account, exposed API token, vulnerable integration, or improperly configured Directus role. 2. The attacker stores malicious HTML in the `content` field of a page or post. 3. The Astro application retrieves the record from Directus. 4 ...[truncated 1041 chars]- Remediation
View remediation