1084 matches found
CVE-2026-126364 Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory...
CVE-2026-126364
The Astro web framework (versions 5.14.3 through 7.4.7) contains a vulnerability in the /_image endpoint of the @astrojs/node adapter. The issue stems from a failure to preserve case sensitivity when comparing requested local-image paths against the build output directory on case-sensitive filesy...
CVE-2026-126363
The @astrojs/solid-js renderer (versions 0.2.0 to 7.1.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) because it inserts named slots into the name attribute of an element without proper HTML escaping . An attacker can provide a request-controlled slot name containing a quote (e.g., via...
CVE-2026-126362
The @astrojs/svelte renderer (versions >= 5.7.3 and <= 9.1.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) because it inserts named slots into the name attribute of an wrapper without proper HTML escaping. An attacker can provide a request-controlled input (e.g., via a query para...
CVE-2026-126361
The web framework Astro is vulnerable to Cross-Site Scripting (XSS) via attribute injection in dynamic tag names prior to version 7.4.5 . The vulnerability exists because the .astro , JSX , and MDX renderers processed dynamic element names as raw HTML using an incomplete character filter. An atta...
Website
The New Oil Mission Statement To educate readers on why privacy and security matter, and the various tools and techniques available to help them reclaim and protect their own privacy & security To empower readers to believe that privacy and security are attainable for everyone and to do their bes...
CVE-2024-56924
CVE-2024-56924 Vulnerability Description A Cross-Site Request Forgery CSRF vulnerability exists in the code astro Internet Banking System version 2.0.0, which allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as administrators, without their knowledge...
Astro Cloudflare Adapter - Server Side Request Forgery
Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...
Astro - Unauthorized Third-Party Image Access
Astro 5.13.2 and 4.16.18 contains an information disclosure vulnerability caused by improper validation of protocol-relative URLs in the image optimization endpoint, letting attackers serve images from unauthorized third-party domains, exploit requires on-demand rendering deployment. id:...
Astro SSR - Server-Side Request Forgery
Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...
Astro SSR - Open Redirect
Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. id: CVE-2025-54793...
Astro - Information Disclosure
Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enable...
CVE-2025-58179-Check
CVE-2025-58179-Check CVE-2025-58179-Check is a simple Python script to verify SSRF Server-Side Request Forgery / Content Spoofing vulnerability on the /image endpoint in the Astro framework. This vulnerability is tracked as GHSA-qpr4-c339-7vq8 and CVE-2025-58179. Vulnerability Background This...
astro_CVE-2026-33532
Astro Starter Kit: Minimal npm create astro@latest -- --template minimal 🧑🚀 Seasoned astronaut? Delete this file. Have fun! 🚀 Project Structure Inside of your Astro project, you'll see the following folders and files: / ├── public/ ├── src/ │ └── pages/ │ └── index.astro └── package.json Astro...
CLSA-2026-1793811309 TuxCare security update for astro (1 CVE)
TuxCare rebuilt astro to address 1 CVE. Fixed in 2.10.15-tuxcare.12...
CLSA-2026-1793811117 TuxCare security update for astro (1 CVE)
TuxCare rebuilt astro to address 1 CVE. Fixed in 5.18.1-tuxcare.10...
CLSA-2026-1793811013 TuxCare security update for astro (1 CVE)
TuxCare rebuilt astro to address 1 CVE. Fixed in 5.18.2-tuxcare.4...
CLSA-2026-1793810909 TuxCare security update for astro (1 CVE)
TuxCare rebuilt astro to address 1 CVE. Fixed in 4.16.19-tuxcare.10...
CVE-2026-117183
A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...
