DOM Clobbering Gadget found in astro's client-side router that leads to XSS

🗓️ 14 Oct 2024 20:02:21Reported by GitHub Advisory DatabaseType

DOM Clobbering Gadget in Astro's client-side router can lead to XSS. Vulnerable code in `<ViewTransitions />` component allows execution of attacker-controlled scriptless HTML elements. It bypasses data-astroExec and type attribute checks, resulting in XSS

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-47885	14 Oct 202421:42	–	circl
CNNVD	Astro 跨站脚本漏洞	14 Oct 202400:00	–	cnnvd
CVE	CVE-2024-47885	14 Oct 202419:06	–	cve
Cvelist	CVE-2024-47885 astro's client-side router has DOM Clobbering Gadget that leads to XSS	14 Oct 202419:06	–	cvelist
EUVD	EUVD-2024-3078	3 Oct 202520:07	–	euvd
NVD	CVE-2024-47885	14 Oct 202419:15	–	nvd
OSV	CVE-2024-47885 astro's client-side router has DOM Clobbering Gadget that leads to XSS	14 Oct 202419:06	–	osv
OSV	GHSA-M85W-3H95-HCF9 DOM Clobbering Gadget found in astro's client-side router that leads to XSS	14 Oct 202420:02	–	osv
Positive Technologies	PT-2024-32873 · Astro · Astro	14 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-47885	23 May 202510:44	–	redhatcve

Vulners

Node

astro astroRange3.0.0–4.16.1npm

Source	Link
github	www.github.com/withastro/astro/security/advisories/GHSA-m85w-3h95-hcf9
github	www.github.com/withastro/astro/commit/a4ffbfaa5cb460c12bd486fd75e36147f51d3e5e
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-47885
github	www.github.com/withastro/astro/blob/7814a6cad15f06931f963580176d9b38aa7819f2/packages/astro/src/transitions/router.ts
github	www.github.com/advisories/GHSA-m85w-3h95-hcf9

27 Nov 2025 08:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.4 - 5.9

EPSS0.0094

SSVC

CWE-79