Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/790063?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/790063?format=api", "purl": "pkg:npm/astro@0.0.0-middleware-20230412124602", "type": "npm", "namespace": "", "name": "astro", "version": "0.0.0-middleware-20230412124602", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "6.1.6", "latest_non_vulnerable_version": "6.1.10", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/48412?format=api", "vulnerability_id": "VCID-4nsb-h2qe-tug9", "summary": "Astro Development Server has Arbitrary Local File Read\nA vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-64757", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00022", "scoring_system": "epss", "scoring_elements": "0.06319", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00022", "scoring_system": "epss", "scoring_elements": "0.06329", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-64757" }, { "reference_url": "https://github.com/withastro/astro", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro" }, { "reference_url": "https://github.com/withastro/astro/commit/b8ca69b97149becefaf89bf21853de9c905cdbb7", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-19T21:04:14Z/" } ], "url": "https://github.com/withastro/astro/commit/b8ca69b97149becefaf89bf21853de9c905cdbb7" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64757", "reference_id": "CVE-2025-64757", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64757" }, { "reference_url": "https://github.com/advisories/GHSA-x3h8-62x9-952g", "reference_id": "GHSA-x3h8-62x9-952g", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-x3h8-62x9-952g" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g", "reference_id": "GHSA-x3h8-62x9-952g", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-19T21:04:14Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/70823?format=api", "purl": "pkg:npm/astro@5.14.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-gmum-ebwt-f3at" }, { "vulnerability": "VCID-j5k1-5dfe-8udj" }, { "vulnerability": "VCID-jcqr-tk29-xbat" }, { "vulnerability": "VCID-k4f1-y5qy-9ka4" }, { "vulnerability": "VCID-rjus-p7ga-fugs" }, { "vulnerability": "VCID-tkwe-8ejd-mfb6" }, { "vulnerability": "VCID-wvqv-3kwm-1uba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@5.14.3" } ], "aliases": [ "CVE-2025-64757", "GHSA-x3h8-62x9-952g" ], "risk_score": 1.6, "exploitability": "0.5", "weighted_severity": "3.1", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4nsb-h2qe-tug9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/56370?format=api", "vulnerability_id": "VCID-8x71-29mv-2qfp", "summary": "Atro CSRF Middleware Bypass (security.checkOrigin)\nA bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-56140", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00196", "scoring_system": "epss", "scoring_elements": "0.41418", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00196", "scoring_system": "epss", "scoring_elements": "0.41413", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-56140" }, { "reference_url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-18T21:03:26Z/" } ], "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests" }, { "reference_url": "https://github.com/withastro/astro", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro" }, { "reference_url": "https://github.com/withastro/astro/blob/6031962ab5f56457de986eb82bd24807e926ba1b/packages/astro/src/core/app/middlewares.ts", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-18T21:03:26Z/" } ], "url": "https://github.com/withastro/astro/blob/6031962ab5f56457de986eb82bd24807e926ba1b/packages/astro/src/core/app/middlewares.ts" }, { "reference_url": "https://github.com/withastro/astro/commit/e7d14c374b9d45e27089994a4eb72186d05514de", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-18T21:03:26Z/" } ], "url": "https://github.com/withastro/astro/commit/e7d14c374b9d45e27089994a4eb72186d05514de" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56140", "reference_id": "CVE-2024-56140", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56140" }, { "reference_url": "https://github.com/advisories/GHSA-c4pw-33h3-35xw", "reference_id": "GHSA-c4pw-33h3-35xw", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-c4pw-33h3-35xw" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-c4pw-33h3-35xw", "reference_id": "GHSA-c4pw-33h3-35xw", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-18T21:03:26Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-c4pw-33h3-35xw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/83577?format=api", "purl": "pkg:npm/astro@4.16.17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4nsb-h2qe-tug9" }, { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-gmum-ebwt-f3at" }, { "vulnerability": "VCID-j5k1-5dfe-8udj" }, { "vulnerability": "VCID-jcqr-tk29-xbat" }, { "vulnerability": "VCID-k4f1-y5qy-9ka4" }, { "vulnerability": "VCID-qcs7-nt67-7qe5" }, { "vulnerability": "VCID-qt1f-1dkr-y3gs" }, { "vulnerability": "VCID-rjus-p7ga-fugs" }, { "vulnerability": "VCID-w3zj-e7u2-2fh1" }, { "vulnerability": "VCID-wvqv-3kwm-1uba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@4.16.17" } ], "aliases": [ "CVE-2024-56140", "GHSA-c4pw-33h3-35xw" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8x71-29mv-2qfp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/89049?format=api", "vulnerability_id": "VCID-a19r-4mhu-syhd", "summary": "Astro: XSS in define:vars via incomplete </script> tag sanitization\n## Summary\n\nThe `defineScriptVars` function in Astro's server-side rendering pipeline uses a case-sensitive regex `/<\\/script>/g` to sanitize values injected into inline `<script>` tags via the `define:vars` directive. HTML parsers close `<script>` elements case-insensitively and also accept whitespace or `/` before the closing `>`, allowing an attacker to bypass the sanitization with payloads like `</Script>`, `</script >`, or `</script/>` and inject arbitrary HTML/JavaScript.\n\n## Details\n\nThe vulnerable function is `defineScriptVars` at `packages/astro/src/runtime/server/render/util.ts:42-53`:\n\n```typescript\nexport function defineScriptVars(vars: Record<any, any>) {\n\tlet output = '';\n\tfor (const [key, value] of Object.entries(vars)) {\n\t\toutput += `const ${toIdent(key)} = ${JSON.stringify(value)?.replace(\n\t\t\t/<\\/script>/g, // ← Case-sensitive, exact match only\n\t\t\t'\\\\x3C/script>',\n\t\t)};\\n`;\n\t}\n\treturn markHTMLString(output);\n}\n```\n\nThis function is called from `renderElement` at `util.ts:172-174` when a `<script>` element has `define:vars`:\n\n```typescript\nif (name === 'script') {\n\tdelete props.hoist;\n\tchildren = defineScriptVars(defineVars) + '\\n' + children;\n}\n```\n\nThe regex `/<\\/script>/g` fails to match three classes of closing script tags that HTML parsers accept per the [HTML specification §13.2.6.4](https://html.spec.whatwg.org/multipage/parsing.html#parsing-main-inbody):\n\n1. **Case variations**: `</Script>`, `</SCRIPT>`, `</sCrIpT>` — HTML tag names are case-insensitive but the regex has no `i` flag.\n2. **Whitespace before `>`**: `</script >`, `</script\\t>`, `</script\\n>` — after the tag name, the HTML tokenizer enters the \"before attribute name\" state on ASCII whitespace.\n3. **Self-closing slash**: `</script/>` — the tokenizer enters \"self-closing start tag\" state on `/`.\n\n`JSON.stringify()` does not escape `<`, `>`, or `/` characters, so all these payloads pass through serialization unchanged.\n\n**Execution flow:** User-controlled input (e.g., `Astro.url.searchParams`) → assigned to a variable → passed via `define:vars` on a `<script>` tag → `renderElement` → `defineScriptVars` → incomplete sanitization → injected into `<script>` block in HTML response → browser closes the script element early → attacker-controlled HTML parsed and executed.\n\n## PoC\n\n**Step 1:** Create an SSR Astro page (`src/pages/index.astro`):\n\n```astro\n---\nconst name = Astro.url.searchParams.get('name') || 'World';\n---\n<html>\n<body>\n <h1>Hello</h1>\n <script define:vars={{ name }}>\n console.log(name);\n </script>\n</body>\n</html>\n```\n\n**Step 2:** Ensure SSR is enabled in `astro.config.mjs`:\n\n```js\nexport default defineConfig({\n output: 'server'\n});\n```\n\n**Step 3:** Start the dev server and visit:\n\n```\nhttp://localhost:4321/?name=</Script><img/src=x%20onerror=alert(document.cookie)>\n```\n\n**Step 4:** View the HTML source. The output contains:\n\n```html\n<script>const name = \"</Script><img/src=x onerror=alert(document.cookie)>\";\n console.log(name);\n</script>\n```\n\nThe browser's HTML parser matches `</Script>` case-insensitively, closing the script block. The `<img onerror=alert(document.cookie)>` is then parsed as HTML and the JavaScript in `onerror` executes.\n\n**Alternative bypass payloads:**\n\n```\n/?name=</script ><img/src=x onerror=alert(1)>\n/?name=</script/><img/src=x onerror=alert(1)>\n/?name=</SCRIPT><img/src=x onerror=alert(1)>\n```\n\n## Impact\n\nAn attacker can execute arbitrary JavaScript in the context of a victim's browser session on any SSR Astro application that passes request-derived data to `define:vars` on a `<script>` tag. This is a documented and expected usage pattern in Astro.\n\nExploitation enables:\n- **Session hijacking** via cookie theft (`document.cookie`)\n- **Credential theft** by injecting fake login forms or keyloggers\n- **Defacement** of the rendered page\n- **Redirection** to attacker-controlled domains\n\nThe vulnerability affects all Astro versions that support `define:vars` and is exploitable in any SSR deployment where user input reaches a `define:vars` script variable.\n\n## Recommended Fix\n\nReplace the case-sensitive exact-match regex with a comprehensive escape that covers all HTML parser edge cases. The simplest correct fix is to escape all `<` characters in the JSON output:\n\n```typescript\nexport function defineScriptVars(vars: Record<any, any>) {\n\tlet output = '';\n\tfor (const [key, value] of Object.entries(vars)) {\n\t\toutput += `const ${toIdent(key)} = ${JSON.stringify(value)?.replace(\n\t\t\t/</g,\n\t\t\t'\\\\u003c',\n\t\t)};\\n`;\n\t}\n\treturn markHTMLString(output);\n}\n```\n\nThis is the standard approach used by frameworks like Next.js and Rails. Replacing every `<` with `\\u003c` is safe inside JSON string contexts (JavaScript treats `\\u003c` as `<` at runtime) and eliminates all possible `</script>` variants including case variations, whitespace, and self-closing forms.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41067", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00053", "scoring_system": "epss", "scoring_elements": "0.16956", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00053", "scoring_system": "epss", "scoring_elements": "0.16951", "published_at": "2026-06-06T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41067" }, { "reference_url": "https://github.com/withastro/astro", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro" }, { "reference_url": "https://github.com/withastro/astro/releases/tag/astro@6.1.6", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro/releases/tag/astro@6.1.6" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-24T17:27:06Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41067", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41067" }, { "reference_url": "https://github.com/advisories/GHSA-j687-52p2-xcff", "reference_id": "GHSA-j687-52p2-xcff", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-j687-52p2-xcff" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109972?format=api", "purl": "pkg:npm/astro@6.1.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@6.1.6" } ], "aliases": [ "CVE-2026-41067", "GHSA-j687-52p2-xcff" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a19r-4mhu-syhd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/48414?format=api", "vulnerability_id": "VCID-gmum-ebwt-f3at", "summary": "Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint\n**Summary**\nA Cross-Site Scripting (XSS) vulnerability exists in Astro when using the **@astrojs/cloudflare** adapter with `output: 'server'`. The built-in image optimization endpoint (`/_image`) uses `isRemoteAllowed()` from Astro’s internal helpers, which **unconditionally allows `data:` URLs**. When the endpoint receives a valid `data:` URL pointing to a malicious SVG containing JavaScript, and the Cloudflare-specific implementation performs a **302 redirect back to the original `data:` URL**, the browser directly executes the embedded JavaScript. This completely bypasses any domain allow-listing (`image.domains` / `image.remotePatterns`) and typical Content Security Policy mitigations.\n\n**Affected Versions**\n- `@astrojs/cloudflare` ≤ 12.6.10 (and likely all previous versions)\n- Astro ≥ 4.x when used with `output: 'server'` and the Cloudflare adapter\n\n**Root Cause – Vulnerable Code**\nFile: `node_modules/@astrojs/internal-helpers/src/remote.ts`\n\n```ts\nexport function isRemoteAllowed(src: string, ...): boolean {\nif (!URL.canParse(src)) {\nreturn false;\n}\nconst url = new URL(src);\n\n// Data URLs are always allowed\nif (url.protocol === 'data:') {\nreturn true;\n}\n\n// Non-http(s) protocols are never allowed\nif (!['http:', 'https:'].includes(url.protocol)) {\nreturn false;\n}\n// ... further http/https allow-list checks\n}\n```\n\nIn the **Cloudflare adapter**, the `/_image` endpoint contains logic similar to:\n\n```ts\nconst href = ctx.url.searchParams.get('href');\nif (!href) {\n// return error\n}\n\nif (isRemotePath(href)) {\nif (isRemoteAllowed(href, imageConfig) === false) {\n// return error\n} else {\n//redirect to return the image\nreturn Response.redirect(href, 302);\n}\n}\n```\n\nBecause `data:` URLs are considered “allowed”, a request such as:\n`https://example.com/_image?href=data:image/svg+xml;base64,PHN2Zy... (base64-encoded malicious SVG)`\n\ntriggers a **302 redirect directly to the `data:` URL**, causing the browser to render and execute the malicious JavaScript inside the SVG.\n\n**Proof of Concept (PoC)**\n\n1. Create a minimal Astro project with Cloudflare adapter (`output: 'server'`).\n2. Deploy to Cloudflare Pages or Workers.\n3. Request the image endpoint with the following payload:", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-65019", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00033", "scoring_system": "epss", "scoring_elements": "0.10219", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00033", "scoring_system": "epss", "scoring_elements": "0.10199", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-65019" }, { "reference_url": "https://github.com/withastro/astro", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro" }, { "reference_url": "https://github.com/withastro/astro/commit/9e9c528191b6f5e06db9daf6ad26b8f68016e533", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-19T21:05:09Z/" } ], "url": "https://github.com/withastro/astro/commit/9e9c528191b6f5e06db9daf6ad26b8f68016e533" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65019", "reference_id": "CVE-2025-65019", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65019" }, { "reference_url": "https://github.com/advisories/GHSA-fvmw-cj7j-j39q", "reference_id": "GHSA-fvmw-cj7j-j39q", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fvmw-cj7j-j39q" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q", "reference_id": "GHSA-fvmw-cj7j-j39q", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-19T21:05:09Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/71460?format=api", "purl": "pkg:npm/astro@5.15.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-jcqr-tk29-xbat" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@5.15.9" } ], "aliases": [ "CVE-2025-65019", "GHSA-fvmw-cj7j-j39q" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gmum-ebwt-f3at" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49361?format=api", "vulnerability_id": "VCID-k4f1-y5qy-9ka4", "summary": "Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765\nA **double URL encoding bypass** allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 (single URL encoding) was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs like `/%2561dmin` instead of `/%61dmin`, attackers can still bypass authentication and access protected resources such as `/admin`, `/api/internal`, or any route protected by middleware pathname checks.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-66202", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00299", "scoring_system": "epss", "scoring_elements": "0.53589", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00299", "scoring_system": "epss", "scoring_elements": "0.5358", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-66202" }, { "reference_url": "https://github.com/withastro/astro", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro" }, { "reference_url": "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-09T14:18:21Z/" } ], "url": "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64765", "reference_id": "CVE-2025-64765", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64765" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66202", "reference_id": "CVE-2025-66202", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66202" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794", "reference_id": "GHSA-ggxq-hp9w-j794", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-09T14:18:21Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794" }, { "reference_url": "https://github.com/advisories/GHSA-whqg-ppgf-wp8c", "reference_id": "GHSA-whqg-ppgf-wp8c", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-whqg-ppgf-wp8c" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c", "reference_id": "GHSA-whqg-ppgf-wp8c", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-09T14:18:21Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/71461?format=api", "purl": "pkg:npm/astro@5.15.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-gmum-ebwt-f3at" }, { "vulnerability": "VCID-jcqr-tk29-xbat" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@5.15.8" } ], "aliases": [ "CVE-2025-66202", "GHSA-whqg-ppgf-wp8c" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-k4f1-y5qy-9ka4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57897?format=api", "vulnerability_id": "VCID-qcs7-nt67-7qe5", "summary": "Astro allows unauthorized third-party images in _image endpoint\nIn affected versions of `astro`, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55303", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00134", "scoring_system": "epss", "scoring_elements": "0.32562", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00134", "scoring_system": "epss", "scoring_elements": "0.32594", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55303" }, { "reference_url": "https://github.com/withastro/astro", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "6.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro" }, { "reference_url": "https://github.com/withastro/astro/commit/4d16de7f95db5d1ec1ce88610d2a95e606e83820", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "6.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-19T20:49:42Z/" } ], "url": "https://github.com/withastro/astro/commit/4d16de7f95db5d1ec1ce88610d2a95e606e83820" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55303", "reference_id": "CVE-2025-55303", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "6.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55303" }, { "reference_url": "https://github.com/advisories/GHSA-xf8x-j4p2-f749", "reference_id": "GHSA-xf8x-j4p2-f749", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-xf8x-j4p2-f749" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-xf8x-j4p2-f749", "reference_id": "GHSA-xf8x-j4p2-f749", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "6.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-19T20:49:42Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-xf8x-j4p2-f749" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/86142?format=api", "purl": "pkg:npm/astro@4.16.19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4nsb-h2qe-tug9" }, { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-gmum-ebwt-f3at" }, { "vulnerability": "VCID-j5k1-5dfe-8udj" }, { "vulnerability": "VCID-jcqr-tk29-xbat" }, { "vulnerability": "VCID-k4f1-y5qy-9ka4" }, { "vulnerability": "VCID-rjus-p7ga-fugs" }, { "vulnerability": "VCID-w3zj-e7u2-2fh1" }, { "vulnerability": "VCID-wvqv-3kwm-1uba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@4.16.19" }, { "url": "http://public2.vulnerablecode.io/api/packages/86141?format=api", "purl": "pkg:npm/astro@5.13.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4nsb-h2qe-tug9" }, { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-gmum-ebwt-f3at" }, { "vulnerability": "VCID-j5k1-5dfe-8udj" }, { "vulnerability": "VCID-jcqr-tk29-xbat" }, { "vulnerability": "VCID-k4f1-y5qy-9ka4" }, { "vulnerability": "VCID-rjus-p7ga-fugs" }, { "vulnerability": "VCID-tkwe-8ejd-mfb6" }, { "vulnerability": "VCID-w3zj-e7u2-2fh1" }, { "vulnerability": "VCID-wvqv-3kwm-1uba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@5.13.2" } ], "aliases": [ "CVE-2025-55303", "GHSA-xf8x-j4p2-f749" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qcs7-nt67-7qe5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/56377?format=api", "vulnerability_id": "VCID-qt1f-1dkr-y3gs", "summary": "Astro's server source code is exposed to the public if sourcemaps are enabled\nA bug in the build process allows any unauthenticated user to read parts of the server source code.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-56159", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.1078", "scoring_system": "epss", "scoring_elements": "0.93492", "published_at": "2026-06-06T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-56159" }, { "reference_url": "https://github.com/getsentry/sentry-javascript/blob/develop/packages/astro/src/integration/index.ts#L50", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-20T20:44:11Z/" } ], "url": "https://github.com/getsentry/sentry-javascript/blob/develop/packages/astro/src/integration/index.ts#L50" }, { "reference_url": "https://github.com/withastro/astro", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro" }, { "reference_url": "https://github.com/withastro/astro/blob/176fe9f113fd912f9b61e848b00bbcfecd6d5c2c/packages/astro/src/core/build/static-build.ts#L139", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-20T20:44:11Z/" } ], "url": "https://github.com/withastro/astro/blob/176fe9f113fd912f9b61e848b00bbcfecd6d5c2c/packages/astro/src/core/build/static-build.ts#L139" }, { "reference_url": "https://github.com/withastro/astro/commit/039d022b1bbaacf9ea83071d27affc5318e0e515", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro/commit/039d022b1bbaacf9ea83071d27affc5318e0e515" }, { "reference_url": "https://github.com/withastro/astro/commit/c879f501ff01b1a3c577de776a1f7100d78f8dd5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro/commit/c879f501ff01b1a3c577de776a1f7100d78f8dd5" }, { "reference_url": "https://github.com/withastro/astro/issues/12703", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-20T20:44:11Z/" } ], "url": "https://github.com/withastro/astro/issues/12703" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56159", "reference_id": "CVE-2024-56159", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56159" }, { "reference_url": "https://github.com/advisories/GHSA-49w6-73cw-chjr", "reference_id": "GHSA-49w6-73cw-chjr", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-49w6-73cw-chjr" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr", "reference_id": "GHSA-49w6-73cw-chjr", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-20T20:44:11Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/83604?format=api", "purl": "pkg:npm/astro@4.16.18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4nsb-h2qe-tug9" }, { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-gmum-ebwt-f3at" }, { "vulnerability": "VCID-j5k1-5dfe-8udj" }, { "vulnerability": "VCID-jcqr-tk29-xbat" }, { "vulnerability": "VCID-k4f1-y5qy-9ka4" }, { "vulnerability": "VCID-qcs7-nt67-7qe5" }, { "vulnerability": "VCID-rjus-p7ga-fugs" }, { "vulnerability": "VCID-w3zj-e7u2-2fh1" }, { "vulnerability": "VCID-wvqv-3kwm-1uba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@4.16.18" }, { "url": "http://public2.vulnerablecode.io/api/packages/83603?format=api", "purl": "pkg:npm/astro@5.0.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4nsb-h2qe-tug9" }, { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-gmum-ebwt-f3at" }, { "vulnerability": "VCID-j5k1-5dfe-8udj" }, { "vulnerability": "VCID-jcqr-tk29-xbat" }, { "vulnerability": "VCID-k4f1-y5qy-9ka4" }, { "vulnerability": "VCID-qcs7-nt67-7qe5" }, { "vulnerability": "VCID-rjus-p7ga-fugs" }, { "vulnerability": "VCID-w3zj-e7u2-2fh1" }, { "vulnerability": "VCID-wvqv-3kwm-1uba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@5.0.8" } ], "aliases": [ "CVE-2024-56159", "GHSA-49w6-73cw-chjr" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qt1f-1dkr-y3gs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/48418?format=api", "vulnerability_id": "VCID-rjus-p7ga-fugs", "summary": "Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values\nA mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies `decodeURI()` to determine which route to render, while the middleware uses `context.url.pathname` without applying the same normalization (decodeURI).\n\nThis discrepancy may allow attackers to reach protected routes (e.g., /admin) using encoded path variants that pass routing but bypass validation checks.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-64765", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00041", "scoring_system": "epss", "scoring_elements": "0.12702", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00041", "scoring_system": "epss", "scoring_elements": "0.12698", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-64765" }, { "reference_url": "https://github.com/withastro/astro", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro" }, { "reference_url": "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-11-20T15:50:37Z/" } ], "url": "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64765", "reference_id": "CVE-2025-64765", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64765" }, { "reference_url": "https://github.com/advisories/GHSA-ggxq-hp9w-j794", "reference_id": "GHSA-ggxq-hp9w-j794", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-ggxq-hp9w-j794" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794", "reference_id": "GHSA-ggxq-hp9w-j794", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-11-20T15:50:37Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/71461?format=api", "purl": "pkg:npm/astro@5.15.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-gmum-ebwt-f3at" }, { "vulnerability": "VCID-jcqr-tk29-xbat" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@5.15.8" } ], "aliases": [ "CVE-2025-64765", "GHSA-ggxq-hp9w-j794" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rjus-p7ga-fugs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/48007?format=api", "vulnerability_id": "VCID-w3zj-e7u2-2fh1", "summary": "Astro's `X-Forwarded-Host` is reflected without validation\nWhen running Astro in on-demand rendering mode using a adapter such as the node adapter it is possible to maliciously send an `X-Forwarded-Host` header that is reflected when using the recommended `Astro.url` property as there is no validation that the value is safe.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-61925", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00057", "scoring_system": "epss", "scoring_elements": "0.18258", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00057", "scoring_system": "epss", "scoring_elements": "0.18254", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-61925" }, { "reference_url": "https://github.com/Chisnet/minimal_dynamic_astro_server", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-10-10T20:00:44Z/" } ], "url": "https://github.com/Chisnet/minimal_dynamic_astro_server" }, { "reference_url": "https://github.com/withastro/astro", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro" }, { "reference_url": "https://github.com/withastro/astro/commit/6ee63bfac4856f21b4d4633021b3d2ee059e553f", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro/commit/6ee63bfac4856f21b4d4633021b3d2ee059e553f" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61925", "reference_id": "CVE-2025-61925", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61925" }, { "reference_url": "https://github.com/advisories/GHSA-5ff5-9fcw-vg88", "reference_id": "GHSA-5ff5-9fcw-vg88", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5ff5-9fcw-vg88" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88", "reference_id": "GHSA-5ff5-9fcw-vg88", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-10-10T20:00:44Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/70823?format=api", "purl": "pkg:npm/astro@5.14.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-gmum-ebwt-f3at" }, { "vulnerability": "VCID-j5k1-5dfe-8udj" }, { "vulnerability": "VCID-jcqr-tk29-xbat" }, { "vulnerability": "VCID-k4f1-y5qy-9ka4" }, { "vulnerability": "VCID-rjus-p7ga-fugs" }, { "vulnerability": "VCID-tkwe-8ejd-mfb6" }, { "vulnerability": "VCID-wvqv-3kwm-1uba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@5.14.3" } ], "aliases": [ "CVE-2025-61925", "GHSA-5ff5-9fcw-vg88" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-w3zj-e7u2-2fh1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/48415?format=api", "vulnerability_id": "VCID-wvqv-3kwm-1uba", "summary": "Astro vulnerable to reflected XSS via the server islands feature\nAfter some research it appears that it is possible to obtain a reflected XSS when the server islands feature is used in the targeted application, **regardless of what was intended by the component template(s)**.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-64764", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47813", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47811", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-64764" }, { "reference_url": "https://github.com/withastro/astro", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/withastro/astro" }, { "reference_url": "https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-19T21:06:04Z/" } ], "url": "https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64764", "reference_id": "CVE-2025-64764", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64764" }, { "reference_url": "https://github.com/advisories/GHSA-wrwg-2hg8-v723", "reference_id": "GHSA-wrwg-2hg8-v723", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wrwg-2hg8-v723" }, { "reference_url": "https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723", "reference_id": "GHSA-wrwg-2hg8-v723", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-19T21:06:04Z/" } ], "url": "https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/71461?format=api", "purl": "pkg:npm/astro@5.15.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a19r-4mhu-syhd" }, { "vulnerability": "VCID-gmum-ebwt-f3at" }, { "vulnerability": "VCID-jcqr-tk29-xbat" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@5.15.8" } ], "aliases": [ "CVE-2025-64764", "GHSA-wrwg-2hg8-v723" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wvqv-3kwm-1uba" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/astro@0.0.0-middleware-20230412124602" }