VulnCheck KEV: CVE-2025-55303

Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include a...

VulnCheck KEV: CVE-2024-56159

Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files for the server code are moved to a publicly-accessible...

CVE-2025-69618

An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information...

CVE-2025-69618

An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information...

PT-2026-5973

Name of the Vulnerable Software and Affected Versions Tarot, Astro & Healing version 11.4.0 Description A flaw exists in the file import process that allows overwriting of critical internal files. Successful exploitation could lead to arbitrary code execution or disclosure of sensitive informatio...

EUVD-2025-206818

An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information...

CVE-2025-69618

An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information...

CVE-2025-69618

The Tarot, Astro & Healing platform (v11.4.0) contains an arbitrary file overwrite vulnerability within its file import process . This flaw allows an attacker to overwrite critical internal files, which could result in arbitrary code execution or the exposure of sensitive information . At this ti...

CVE-2025-69618: Improper Limitation of a Pathname to a Restricted Directory

An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information...

@knowbl_ai/nexus-chat (1.0.0), @wistia/wistia-player (0.4.0) +2 more potentially affected by CVE-2026-22028 via preact (>=10.28.0, <=10.28.1)

preact NPM version =10.28.0, =10.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on preact and may be impacted: - @knowblai/nexus-chat 1.0.0 - @wistia/wistia-player 0.4.0 - @wistia/wistia-player-react 0.4.0 - astro-og 0.3.1 Source cves: CVE-2026-2202...

@knowbl_ai/nexus-chat (1.0.0), @wistia/wistia-player (0.4.0) +2 more potentially affected by CVE-2026-22028 via preact (>=10.28.0, <=10.28.1)

preact NPM version =10.28.0, =10.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on preact and may be impacted: - @knowblai/nexus-chat 1.0.0 - @wistia/wistia-player 0.4.0 - @wistia/wistia-player-react 0.4.0 - astro-og 0.3.1 Source cves: CVE-2026-2202...

Astro < 5.15.8 Reflected Cross-Site Scripting

Astro framework versions prior to 5.15.8 are vulnerable to a Reflected Cross-Site Scripting ... No source data...

VulnCheck KEV: CVE-2025-64764

Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component templates. This issue has been patched in version 5.15.8...

CVE-2025-66202

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8,...

CVE-2025-66202

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8,...

Astro security vulnerabilities

Astro is an Astro open source web framework for content-driven websites. A security vulnerability exists in Astro versions 5.15.7 and below, which stems from a double URL encoding bypass that could allow an unauthenticated attacker to access protected routes...

CVE-2025-66202: Use of Non-Canonical URL Paths for Authorization Decisions

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8,...

CVE-2025-66202

Astro (web framework) is affected by CVE-2025-66202: versions 5.15.7 and below are vulnerable to a double URL encoding bypass that lets unauthenticated attackers bypass middleware pathname checks and access protected routes. The fix for CVE-2025-64765 in 5.15.8 decodes URLs only once, leaving roo...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @ampt/astro (0.0.1-beta.1) +397 more potentially affected by CVE-2025-66202 via astro (>=0.20.12, <=5.15.6)

astro NPM version =0.20.12, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =0.0.17, =0.0.2, =0.0.1, =0.2.0, =0.0.0-experimental-7c2f356, =0.0.0-experimental-7c2f356, =0.5.1 - @astro-sanctuary/toolbar-drupal 0.1.1 and more Source cves: CVE-2025-66202 Source advisory: MEND:CVE-2025-66202...

CVE-2025-66202

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8,...