TI-2024-37142 CVE-2024-56159 · GHSA-49w6-73cw-chjr
Server source code is exposed to the public if sourcemaps are enabled
Priority HIGH 73
Astro is a web framework for content-driven websites.
withastro
Records44All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9
Exploited now
withastro records in CISA KEVNo withastro vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
20 records in Astro · all components
TI-2025-34958 CVE-2025-55303 · GHSA-xf8x-j4p2-f749
Unauthorized third-party images in Astro’s _image endpoint
Priority HIGH 70
Astro is a web framework for content-driven websites.
TI-2025-39915 CVE-2025-64525 · GHSA-hr2q-hp5q-x767
Server-side request forgery in withastro astro
Priority HIGH 68
Astro is a web framework.
TI-2025-38274 CVE-2025-61925 · GHSA-5ff5-9fcw-vg88
Astro's `X-Forwarded-Host` is reflected with no validation
Priority HIGH 68
Astro is a web framework.
TI-2026-36915 CVE-2026-50146 · GHSA-8hv8-536x-4wqp
Astro: Reflected XSS via unescaped slot name
Priority MEDIUM 64
Astro is a web framework.
TI-2025-40102 CVE-2025-64764 · GHSA-wrwg-2hg8-v723
Astro is vulnerable to Reflected XSS via the server islands feature
Priority MEDIUM 64
Astro is a web framework.
TI-2025-34548 CVE-2025-54793 · GHSA-cq8c-xv66-36gw
Astro: Duplicate trailing slash feature can lead to Open Redirects
Priority MEDIUM 64
Astro is a web framework for content-driven websites.
TI-2024-37133 CVE-2024-56140 · GHSA-c4pw-33h3-35xw
Bypass of CSRF Middleware in Astro
Priority MEDIUM 62
Astro is a web framework for content-driven websites.
TI-2026-39194 CVE-2026-54298 · GHSA-jrpj-wcv7-9fh9
Astro: XSS via Unescaped Attribute Names in Spread Props
Priority MEDIUM 60
Astro is a web framework.
TI-2026-29706 CVE-2026-41067 · GHSA-j687-52p2-xcff
Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass
Priority MEDIUM 60
Astro is a web framework.
TI-2025-40205 CVE-2025-65019 · GHSA-fvmw-cj7j-j39q
Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint
Priority MEDIUM 60
Astro is a web framework.
TI-2025-40083 CVE-2025-64745 · GHSA-w2vj-39qv-7vh7
Astro development server error page vulnerable to reflected Cross-site Scripting
Priority MEDIUM 60
Astro is a web framework.
TI-2024-32139 CVE-2024-47885 · GHSA-m85w-3h95-hcf9
astro's client-side router has DOM Clobbering Gadget that leads to XSS
Priority MEDIUM 60
The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1.
TI-2025-40095 CVE-2025-64757 · GHSA-x3h8-62x9-952g
Astro Development Server is Vulnerable to Arbitrary Local File Read
Priority MEDIUM 50
Astro is a web framework.
TI-2026-26148 CVE-2026-33769 · GHSA-g735-7g2w-hh3f
Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Priority MEDIUM 48
Astro is a web framework.
TI-2025-37276 CVE-2025-59837 · GHSA-qcpr-679q-rhm2
astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
Priority LOW 38
Astro is a web framework that includes an image proxy.
TI-2025-40103 CVE-2025-64765 · GHSA-ggxq-hp9w-j794
Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values
Priority LOW 37
Astro is a web framework.
TI-2025-40706 CVE-2025-66202 · GHSA-whqg-ppgf-wp8c
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
Priority LOW 35
Astro is a web framework.
TI-2026-39195 CVE-2026-54299 · GHSA-2pvr-wf23-7pc7
Improper input validation in withastro astro
Priority LOW 33
Astro is a web framework.
TI-2026-32882 CVE-2026-45028 · GHSA-xr5h-phrj-8vxv
Astro: Server island encrypted parameters vulnerable to cross-component replay
Priority LOW 19
Astro is a web framework.