CVE-2025-58179-Check

CVE-2025-58179-Check CVE-2025-58179-Check es un script simple de Python para verificar la vulnerabilidad SSRF Server-Side Request Forgery / Content Spoofing en el endpoint /image del framework Astro. Esta vulnerabilidad se rastrea como GHSA-qpr4-c339-7vq8 y CVE-2025-58179. Antecedentes de la...

Website

The New Oil 使命宣言 旨在教育 读者了解隐私和安全为何重要，以及可用的各种工具和技术，帮助他们重新获得并保护自己的隐私和安全 旨在赋能 读者，让他们相信隐私和安全是每个人都可以实现的，并尽最大努力重新获得并尽可能保护自己的隐私和安全 旨在改善 读者的生活，提供能够提升其隐私和安全水平的工具，同时不会对其心理或情绪健康、职业或社交生活产生负面影响 有关如何在本地机器上设置该项目的详细指南，请点击此链接。感谢 Rik 和 Jaden 使用 Astro 框架搭建了网站，将整体设计更新得更加现代化，并持续协助解决任何重大问题。 贡献...

Astro - Unauthorized Third-Party Image Access

Astro 5.13.2 and 4.16.18 contains an information disclosure vulnerability caused by improper validation of protocol-relative URLs in the image optimization endpoint, letting attackers serve images from unauthorized third-party domains, exploit requires on-demand rendering deployment. id:...

Astro Cloudflare Adapter - Server Side Request Forgery

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...

Astro SSR - Server-Side Request Forgery

Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...

Astro SSR - Open Redirect

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. id: CVE-2025-54793...

Astro - Information Disclosure

Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enable...

CVE-2024-56924

CVE-2024-56924 Descripción de la vulnerabilidad Existe una vulnerabilidad de Cross-Site Request Forgery CSRF en el código del astro Internet Banking System versión 2.0.0, que permite a atacantes remotos realizar acciones no autorizadas en nombre de usuarios autenticados, como administradores, sin...

astro_CVE-2026-33532

Kit de Inicio Astro: Mínimo root@kitploit: npm create astro@latest -- --template minimal 🧑‍🚀 ¿Astronauta experimentado? ¡Elimina este archivo y diviértete! 🚀 Estructura del Proyecto Dentro de tu proyecto Astro, verás las siguientes carpetas y archivos: root@kitploit: / ├── public/ ├── src/ │ └──...

Astro: Remote code execution through AVIF image optimization

A vulnerability in libheif, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized. Projects are affected when an attacker can cause Astro to process an untrusted AVIF image. The fix was released in Astro 7.2.8, which requires...

EUVD-2026-70213

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base...

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Summary Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observe...

Astro - Reflected XSS via server islands feature

Astro 5.15.8 contains a reflected XSS caused by improper handling of server islands feature, letting remote attackers execute scripts, exploit requires use of server islands in the application. id: CVE-2025-64764 info: name: Astro - Reflected XSS via server islands feature author: DhiyaneshDk,zhe...

Astro - Broken Access Control

Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers. id: CVE-2025-64525...

CVE-2026-84376

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...

CVE-2026-84376

Astro is a web framework for content-driven websites. Prior to 7.2.4 , it stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. For example, with base "/app", a request to "/appX/admin" resolved internally to the pro...

CVE-2026-84376 Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...

CVE-2026-84376 Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...

PT-2026-84826

Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.2.4 Description Astro improperly handles the removal of a configured non-root base path from request pathnames by using a string-prefix check that fails to verify path-segment boundaries. This allows an unauthenticate...

CVE-2026-73423

A flaw was found in Astro. The composable astro/hono pipeline can bypass origin checks, which are designed to prevent unauthorized cross-site requests. This occurs because the security.checkOrigin mechanism is not consistently applied when middleware is absent or misordered in the pipeline. A...