Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fzh9-5617-wkd5
Vulnerability ID VCID-fzh9-5617-wkd5
Aliases CVE-2025-64745
GHSA-w2vj-39qv-7vh7
Summary Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this vulnerability only affects the development server and not production builds, it could be exploited to compromise developer environments through social engineering or malicious links. Version 5.15.6 fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 2.7
Risk 1.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2025-64745
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2025-64745
cvssv3.1_qr LOW https://github.com/advisories/GHSA-w2vj-39qv-7vh7
cvssv3.1 2.7 https://github.com/withastro/astro
generic_textual LOW https://github.com/withastro/astro
cvssv3.1 2.7 https://github.com/withastro/astro/blob/5bc37fd5cade62f753aef66efdf40f982379029a/packages/astro/src/template/4xx.ts#L133-L149
generic_textual LOW https://github.com/withastro/astro/blob/5bc37fd5cade62f753aef66efdf40f982379029a/packages/astro/src/template/4xx.ts#L133-L149
ssvc Track https://github.com/withastro/astro/blob/5bc37fd5cade62f753aef66efdf40f982379029a/packages/astro/src/template/4xx.ts#L133-L149
cvssv3.1 2.7 https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91
generic_textual LOW https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91
ssvc Track https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91
cvssv3.1 2.7 https://github.com/withastro/astro/pull/12994
generic_textual LOW https://github.com/withastro/astro/pull/12994
ssvc Track https://github.com/withastro/astro/pull/12994
cvssv3.1 2.7 https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7
cvssv3.1_qr LOW https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7
generic_textual LOW https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7
ssvc Track https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7
cvssv3.1 2.7 https://nvd.nist.gov/vuln/detail/CVE-2025-64745
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2025-64745
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-64745
https://github.com/withastro/astro
12994 https://github.com/withastro/astro/pull/12994
4xx.ts#L133-L149 https://github.com/withastro/astro/blob/5bc37fd5cade62f753aef66efdf40f982379029a/packages/astro/src/template/4xx.ts#L133-L149
790d9425f39bbbb462f1c27615781cd965009f91 https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91
CVE-2025-64745 https://nvd.nist.gov/vuln/detail/CVE-2025-64745
GHSA-w2vj-39qv-7vh7 https://github.com/advisories/GHSA-w2vj-39qv-7vh7
GHSA-w2vj-39qv-7vh7 https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N Found at https://github.com/withastro/astro
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N Found at https://github.com/withastro/astro/blob/5bc37fd5cade62f753aef66efdf40f982379029a/packages/astro/src/template/4xx.ts#L133-L149
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-13T21:19:45Z/ Found at https://github.com/withastro/astro/blob/5bc37fd5cade62f753aef66efdf40f982379029a/packages/astro/src/template/4xx.ts#L133-L149
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N Found at https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-13T21:19:45Z/ Found at https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N Found at https://github.com/withastro/astro/pull/12994
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-13T21:19:45Z/ Found at https://github.com/withastro/astro/pull/12994
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N Found at https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-13T21:19:45Z/ Found at https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-64745
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.11572
EPSS Score 0.00038
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:57:16.794847+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/64xxx/CVE-2025-64745.json 38.6.0