CVE-2025-64764: fallo de gravedad alta en withastro astro
Astro is vulnerable to Reflected XSS via the server islands feature
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
58Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 7.1epss 0.5%
de la publicación al arma
Publicada en NVD19 nov
VulnCheck+26d
Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Productos afectados
withastro · astroCVEs relacionadas — withastro astro
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-25545MEDIUMAstro has Full-Read SSRF in error rendering via Host: header injectionEPSS 1.9%CVE-2024-56159HIGHServer source code is exposed to the public if sourcemaps are enabledEPSS 1.5%CVE-2025-64525MEDIUMAstro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypassEPSS 1.2%CVE-2025-58179HIGHAstro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpointEPSS 0.9%CVE-2026-84376MEDIUMAstro: Authorization bypass from missing path-segment boundary check when stripping the configured baseEPSS 0.7%CVE-2025-54793MEDIUMAstro: Duplicate trailing slash feature can lead to Open RedirectsEPSS 0.7%