Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-b47j-p5et-rfem
Vulnerability ID VCID-b47j-p5et-rfem
Aliases CVE-2026-27829
GHSA-cj9f-h6r6-4cx2
Summary Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize A bug in Astro's image pipeline allows bypassing `image.domains` / `image.remotePatterns` restrictions, enabling the server to fetch content from unauthorized remote hosts.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2026-27829
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2026-27829
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2026-27829
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-cj9f-h6r6-4cx2
cvssv3.1 6.5 https://github.com/withastro/astro
generic_textual MODERATE https://github.com/withastro/astro
cvssv3.1 6.5 https://github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9
generic_textual MODERATE https://github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9
cvssv3.1 6.5 https://github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2
cvssv3.1_qr MODERATE https://github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2
generic_textual MODERATE https://github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2026-27829
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-27829
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-27829
https://github.com/withastro/astro
https://github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9
CVE-2026-27829 https://nvd.nist.gov/vuln/detail/CVE-2026-27829
GHSA-cj9f-h6r6-4cx2 https://github.com/advisories/GHSA-cj9f-h6r6-4cx2
GHSA-cj9f-h6r6-4cx2 https://github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/withastro/astro
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-27829
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.23028
EPSS Score 0.00076
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:50:46.294752+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@astrojs/node/CVE-2026-27829.yml 38.6.0