Website

The New Oil Mission Statement To educate readers on why privacy and security matter, and the various tools and techniques available to help them reclaim and protect their own privacy & security To empower readers to believe that privacy and security are attainable for everyone and to do their bes...

NPM: Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

NPM: Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering vulnerability discovered by ? in WordPress npm astro versions 7.3.2...

EUVD-2026-107411

Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering...

EUVD-2026-107409

Astro: Arbitrary CSS injection in Astro View Transitions...

NPM: Astro: Arbitrary CSS injection in Astro View Transitions

NPM: Astro: Arbitrary CSS injection in Astro View Transitions vulnerability discovered by ? in WordPress npm astro versions = 7.1.0, = 7.3.2...

Astro Cloudflare Adapter - Server Side Request Forgery

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...

Astro - Unauthorized Third-Party Image Access

Astro 5.13.2 and 4.16.18 contains an information disclosure vulnerability caused by improper validation of protocol-relative URLs in the image optimization endpoint, letting attackers serve images from unauthorized third-party domains, exploit requires on-demand rendering deployment. id:...

Astro SSR - Server-Side Request Forgery

Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...

Astro - Information Disclosure

Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enable...

Astro SSR - Open Redirect

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. id: CVE-2025-54793...

CVE-2025-58179-Check

CVE-2025-58179-Check CVE-2025-58179-Check is a simple Python script to verify SSRF Server-Side Request Forgery / Content Spoofing vulnerability on the /image endpoint in the Astro framework. This vulnerability is tracked as GHSA-qpr4-c339-7vq8 and CVE-2025-58179. Vulnerability Background This...

CVE-2026-114127

A flaw was found in Astro. Its server-side View Transition stylesheet generator fails to properly sanitize animation properties when creating transition styles. A remote attacker able to supply input to these properties can inject arbitrary Cascading Style Sheets CSS rules into server-rendered we...

CVE-2026-114128

A flaw was found in Astro. The rendering engine fails to properly sanitize dynamic values placed inside script and style elements, mistakenly treating them as trusted markup. A remote attacker can exploit this issue by supplying crafted input that prematurely closes the tag and injects malicious...

CVE-2026-114128

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...

CVE-2026-114127

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, dela...

CVE-2026-114128

The Astro web framework is vulnerable to Reflected/Stored Cross-Site Scripting (XSS) in versions prior to 7.3.2 . The JSX and MDX rendering pipeline (specifically the astro:jsx renderer ) fails to distinguish between compiler-generated literal content and dynamic expression values within script a...

CVE-2026-114128 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...

CVE-2026-114127

The Astro web framework (versions 7.1.0 to 7.3.3 ) is vulnerable to arbitrary CSS injection within its server-side View Transition CSS generator. The root cause is the failure to keep string animation properties (such as duration , delay , easing , direction , fillMode , or animation names ) with...

CVE-2026-114127 Astro: Arbitrary CSS injection in Astro View Transitions

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, dela...

astro_CVE-2026-33532

Astro Starter Kit: Minimal npm create astro@latest -- --template minimal 🧑‍🚀 Seasoned astronaut? Delete this file. Have fun! 🚀 Project Structure Inside of your Astro project, you'll see the following folders and files: / ├── public/ ├── src/ │ └── pages/ │ └── index.astro └── package.json Astro...