{"kind": "product", "path": "vulns/npm/astro", "name": "astro", "product": "astro", "ecosystem": "npm", "items": [{"id": "CVE-2026-114128", "noindex": false, "published": "2026-10-21T17:32:28.466Z", "modified": "2026-10-23T15:11:02.457Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00321, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114128", "title": "Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering", "description": "Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes attacker-controlled data directly as a dynamic child can allow a value containing a closing script or style tag to terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escape dynamic strings automatically; the issue is limited to script and style children rendered through the astro:jsx renderer, including MDX comp", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-98hj-9722-w3j8", "https://github.com/withastro/astro/pull/17896", "https://github.com/withastro/astro/commit/a548223607b9bb146d5d90ddda495343f9a2a739"], "fixes": ["7.3.2"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-114127", "noindex": false, "published": "2026-10-21T17:30:03.860Z", "modified": "2026-10-21T17:30:03.860Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00394, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114127", "title": "Astro: Arbitrary CSS injection in Astro View Transitions", "description": "Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, delay, easing, direction, fillMode, or animation names can allow CSS delimiters to terminate the declaration and add attacker-selected rules to the server-rendered page. The generated stylesheet still escapes literal less-than characters, so the injected content cannot terminate the style element or directly inject HTML or JavaScript. The injected CSS can", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-mpr7-6m5w-76rw", "https://github.com/withastro/astro/pull/17970", "https://github.com/withastro/astro/commit/0b4dc3a211910b589d3805ab4dfedf11b0e712bb"], "fixes": ["7.3.3"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "GHSA-26w7-cxv4-gfx2", "noindex": false, "published": "2026-09-08T21:26:16Z", "modified": "2026-09-08T21:30:05.563003658Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-26w7-cxv4-gfx2", "title": "Astro: Remote code execution through AVIF image optimization", "description": "A vulnerability in `libheif`, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.\n\nProjects are affected when an attacker can cause Astro to process an untrusted AVIF image.\n\nThe fix was released in Astro 7.2.8, which requires Sharp 0.35.4.", "references": ["https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497", "https://github.com/withastro/astro/security/advisories/GHSA-26w7-cxv4-gfx2", "https://github.com/withastro/astro/commit/ecb4082131490b4fe9a56aa44fda84b54ef8967b"], "fixes": ["7.2.8"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-84376", "noindex": false, "published": "2026-09-02T16:24:23.799Z", "modified": "2026-09-04T02:44:22.828Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00707, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-84376", "title": "Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base", "description": "Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base \"/app\", a request to \"/appX/admin\" resolved internally to the protected \"/admin\" route while middleware observed \"/appX/admin\" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-376h-93r7-7g6f", "https://github.com/withastro/astro/pull/17701", "https://github.com/withastro/astro/commit/05763a0884aabb1da78a2749d5bb9d41ae620527"], "fixes": ["7.2.4"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-73423", "noindex": false, "published": "2026-08-12T20:35:32.181Z", "modified": "2026-08-13T17:53:25.469Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "severity": "medium", "epss": 0.00264, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73423", "title": "Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered", "description": "Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionH", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc", "https://github.com/withastro/astro/pull/17250", "https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a"], "fixes": ["7.0.6"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-73422", "noindex": false, "published": "2026-08-12T20:32:56.729Z", "modified": "2026-08-14T22:12:40.307Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00547, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73422", "title": "Astro: Reflected XSS via unescaped View Transition animation properties", "description": "Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode,", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6", "https://github.com/withastro/astro/pull/17393", "https://github.com/withastro/astro/commit/092da560eea77ee63a3e2c583c80d8238544e42b"], "fixes": ["7.1.0"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-59727", "noindex": false, "published": "2026-07-27T19:42:32.222Z", "modified": "2026-07-28T15:20:18.915Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "low", "epss": 0.00393, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-59727", "title": "Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands", "description": "Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic p", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2", "https://github.com/withastro/astro/pull/17212", "https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294"], "fixes": ["7.0.4"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-59729", "noindex": false, "published": "2026-07-27T19:38:40.372Z", "modified": "2026-07-28T13:48:46.640Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00473, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-59729", "title": "Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)", "description": "Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing \"' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spr", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5", "https://github.com/withastro/astro/pull/17251", "https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d"], "fixes": ["7.0.6"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-59731", "noindex": false, "published": "2026-07-08T16:27:18.496Z", "modified": "2026-07-09T14:38:54.995Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "high", "epss": 0.00331, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-59731", "title": "Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch", "description": "Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv", "https://github.com/withastro/astro/pull/17109", "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785"], "fixes": ["6.4.8"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-54299", "noindex": false, "published": "2026-06-22T17:33:53.235Z", "modified": "2026-06-23T15:06:45.902Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.00333, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-54299", "title": "Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)", "description": "Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the fetch at an arbitrary host and read the response. This vulnerability is fixed in 6.4.6.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-2pvr-wf23-7pc7", "https://nvd.nist.gov/vuln/detail/CVE-2026-54299"], "fixes": ["6.4.6"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-54298", "noindex": false, "published": "2026-06-22T17:33:15.734Z", "modified": "2026-06-23T16:11:01.602Z", "cvss": 4.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00228, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-54298", "title": "Astro: XSS via Unescaped Attribute Names in Spread Props", "description": "Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax {...props} on an HTML element and the object keys come from an untrusted source (API, CMS, URL parameters), an attacker can inject arbitrary HTML attributes including event handlers like onmousemove, onclick, or break out of the attribute context entirely to inject new elements. This vulnerability is fixed in 6.4.6.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-jrpj-wcv7-9fh9", "https://nvd.nist.gov/vuln/detail/CVE-2026-54298"], "fixes": ["6.4.6"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-50146", "noindex": false, "published": "2026-06-22T17:31:56.313Z", "modified": "2026-06-23T14:11:04.510Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00268, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-50146", "title": "Astro: Reflected XSS via unescaped slot name", "description": "Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-8hv8-536x-4wqp", "https://nvd.nist.gov/vuln/detail/CVE-2026-50146"], "fixes": ["6.3.3"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-45028", "noindex": false, "published": "2026-05-13T15:50:49.869Z", "modified": "2026-05-14T18:33:24.630Z", "cvss": 2.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "low", "epss": 0.00144, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-45028", "title": "Astro: Server island encrypted parameters vulnerable to cross-component replay", "description": "Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props (p) value as another component's slots (s) value, or vice versa. Since slots contain raw unescaped HTML while props may contain user-controlled values, this could lead to XSS in applications. This occurs when the application uses server islands, two different server island components share the same key name for a prop and a slot, and an attack", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-xr5h-phrj-8vxv", "https://github.com/withastro/astro/pull/16457", "https://github.com/withastro/astro/commit/3d82220a1549e699e34ed433f3846a919f4c02bd"], "fixes": ["6.1.10"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-41067", "noindex": false, "published": "2026-04-24T16:57:22.940Z", "modified": "2026-04-24T18:16:55.536Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-41067", "title": "Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass", "description": "Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff", "https://nvd.nist.gov/vuln/detail/CVE-2026-41067"], "fixes": ["6.1.6"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2026-33769", "noindex": false, "published": "2026-03-24T18:44:29.169Z", "modified": "2026-03-24T20:13:25.845Z", "cvss": 2.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "low", "epss": 0.00338, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-33769", "title": "Astro: Remote allowlist bypass via unanchored matchPathname wildcard", "description": "Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f", "https://nvd.nist.gov/vuln/detail/CVE-2026-33769"], "fixes": ["5.18.1"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2025-66202", "noindex": false, "published": "2025-12-08T23:41:21.976Z", "modified": "2025-12-09T16:04:07.923Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00314, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-66202", "title": "Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765", "description": "Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c", "https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794", "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce"], "fixes": ["5.15.8"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2025-64765", "noindex": false, "published": "2025-11-19T16:41:19.022Z", "modified": "2025-11-20T15:50:41.540Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00538, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-64765", "title": "Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values", "description": "Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes using encoded path variants that pass routing but bypass validation checks. This issue has been patched in version 5.15.8.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794", "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce", "https://nvd.nist.gov/vuln/detail/CVE-2025-64765"], "fixes": ["5.15.8"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2025-64764", "noindex": false, "published": "2025-11-19T16:41:03.767Z", "modified": "2025-11-19T21:07:23.867Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00528, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-64764", "title": "Astro is vulnerable to Reflected XSS via the server islands feature", "description": "Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723", "https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91", "https://nvd.nist.gov/vuln/detail/CVE-2025-64764"], "fixes": ["5.15.8"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2025-65019", "noindex": false, "published": "2025-11-19T16:40:47.826Z", "modified": "2025-11-19T21:05:19.247Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00274, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-65019", "title": "Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint", "description": "Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections. This issue has been patched in version 5.15.9.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q", "https://github.com/withastro/astro/commit/9e9c528191b6f5e06db9daf6ad26b8f68016e533", "https://nvd.nist.gov/vuln/detail/CVE-2025-65019"], "fixes": ["5.15.9"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}, {"id": "CVE-2025-64757", "noindex": false, "published": "2025-11-19T16:40:36.031Z", "modified": "2025-11-19T21:04:23.556Z", "cvss": 3.5, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.0043, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-64757", "title": "Astro Development Server is Vulnerable to Arbitrary Local File Read", "description": "Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system. This issue has been patched in version 5.14.3.", "references": ["https://github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g", "https://github.com/withastro/astro/commit/b8ca69b97149becefaf89bf21853de9c905cdbb7", "https://nvd.nist.gov/vuln/detail/CVE-2025-64757"], "fixes": ["5.14.3"], "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}]}], "total": 29, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "astro", "path": "vulns/npm/astro", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 2, "kev": 0}, "lastmod": "2026-10-23T15:11:02.457Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}