Vulnerabilities

TI-2026-39195 CVE-2026-54299 · GHSA-2pvr-wf23-7pc7

Improper input validation in withastro astro

LOW 33

Astro is a web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00333 Published 2026-06-22 Fixed in 6.4.6 CWE-20

TI-2026-39194 CVE-2026-54298 · GHSA-jrpj-wcv7-9fh9

Astro: XSS via Unescaped Attribute Names in Spread Props

MEDIUM 60

Astro is a web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00228 Published 2026-06-22 Fixed in 6.4.6 CWE-79

TI-2026-36915 CVE-2026-50146 · GHSA-8hv8-536x-4wqp

Astro: Reflected XSS via unescaped slot name

MEDIUM 64

Astro is a web framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00268 Published 2026-06-22 Fixed in 6.3.3 CWE-80

TI-2026-32882 CVE-2026-45028 · GHSA-xr5h-phrj-8vxv

Astro: Server island encrypted parameters vulnerable to cross-component replay

LOW 19

Astro is a web framework.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.00144 Published 2026-05-13 Fixed in 6.1.10 CWE-323

TI-2026-29706 CVE-2026-41067 · GHSA-j687-52p2-xcff

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

MEDIUM 60

Astro is a web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00189 Published 2026-04-24 Fixed in 6.1.6 CWE-79

TI-2026-26148 CVE-2026-33769 · GHSA-g735-7g2w-hh3f

Astro: Remote allowlist bypass via unanchored matchPathname wildcard

MEDIUM 48

Astro is a web framework.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.00338 Published 2026-03-24 Fixed in 5.18.1 CWE-20

TI-2025-40706 CVE-2025-66202 · GHSA-whqg-ppgf-wp8c

Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

LOW 35

Astro is a web framework.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00333 Published 2025-12-08 Fixed in 5.15.8 CWE-647

TI-2025-40103 CVE-2025-64765 · GHSA-ggxq-hp9w-j794

Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values

LOW 37

Astro is a web framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00538 Published 2025-11-19 Fixed in 5.15.8 CWE-22

TI-2025-40102 CVE-2025-64764 · GHSA-wrwg-2hg8-v723

Astro is vulnerable to Reflected XSS via the server islands feature

MEDIUM 64

Astro is a web framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00528 Published 2025-11-19 Fixed in 5.15.8 CWE-80

TI-2025-40205 CVE-2025-65019 · GHSA-fvmw-cj7j-j39q

Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint

MEDIUM 60

Astro is a web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00274 Published 2025-11-19 Fixed in 5.15.9 CWE-79

TI-2025-40095 CVE-2025-64757 · GHSA-x3h8-62x9-952g

Astro Development Server is Vulnerable to Arbitrary Local File Read

MEDIUM 50

Astro is a web framework.

CVSS 3.1LOW 3.5 Adjacent network No auth User interaction EPSS 0.0043 Published 2025-11-19 Fixed in 5.14.3 CWE-22

TI-2025-40083 CVE-2025-64745 · GHSA-w2vj-39qv-7vh7

Astro development server error page vulnerable to reflected Cross-site Scripting

MEDIUM 60

Astro is a web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00262 Published 2025-11-13 Fixed in 5.15.6 CWE-79

TI-2025-39915 CVE-2025-64525 · GHSA-hr2q-hp5q-x767

Server-side request forgery in withastro astro

HIGH 68

Astro is a web framework.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01245 Published 2025-11-13 Fixed in 5.15.5 CWE-918

TI-2025-37276 CVE-2025-59837 · GHSA-qcpr-679q-rhm2

astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

LOW 38

Astro is a web framework that includes an image proxy.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00351 Published 2025-10-28 Fixed in 5.13.10 CWE-79

TI-2025-38274 CVE-2025-61925 · GHSA-5ff5-9fcw-vg88

Astro's `X-Forwarded-Host` is reflected with no validation

HIGH 68

Astro is a web framework.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00408 Published 2025-10-10 Fixed in 5.14.2, 5.14.3 CWE-470

TI-2025-34958 CVE-2025-55303 · GHSA-xf8x-j4p2-f749

Unauthorized third-party images in Astro’s _image endpoint

HIGH 70

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00637 Published 2025-08-19 Fixed in 5.13.2, 4.16.18 +2 CWE-115

TI-2025-34548 CVE-2025-54793 · GHSA-cq8c-xv66-36gw

Astro: Duplicate trailing slash feature can lead to Open Redirects

MEDIUM 64

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00696 Published 2025-08-08 Fixed in 5.12.8 CWE-601

TI-2024-37142 CVE-2024-56159 · GHSA-49w6-73cw-chjr

Server source code is exposed to the public if sourcemaps are enabled

HIGH 73

Astro is a web framework for content-driven websites.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.01536 Published 2024-12-19 Fixed in 5.0.8, 4.16.18 CWE-219

TI-2024-37133 CVE-2024-56140 · GHSA-c4pw-33h3-35xw

Bypass of CSRF Middleware in Astro

MEDIUM 62

Astro is a web framework for content-driven websites.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00223 Published 2024-12-18 Fixed in 4.16.17 CWE-352

TI-2024-32139 CVE-2024-47885 · GHSA-m85w-3h95-hcf9

astro's client-side router has DOM Clobbering Gadget that leads to XSS

MEDIUM 60

The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1.

CVSS 3.1MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00445 Published 2024-10-14 Fixed in 4.16.1 CWE-79

Vulnerabilities

Filters