1023 matches found
EUVD-2025-180304
Malicious code in astro-cors-pulsar-neutrino npm...
EUVD-2025-177986
Malicious code in magellan-astro-webdriverio-enceladus npm...
EUVD-2025-180302
Malicious code in astro-ignite-scripts-pulsar npm...
EUVD-2025-175973
Malicious code in testcafe-titan-fornax-astro npm...
EUVD-2025-178048
Malicious code in local-astro-inquirer-neptune npm...
EUVD-2025-177531
Malicious code in nova-astro-playwright-mira npm...
EUVD-2025-178887
Malicious code in flare-commitlint-hydra-astro npm...
MAL-2025-186995 Malicious code in flare-commitlint-hydra-astro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51e15093f898681067658fdbfcee562bc41426c8b5067bf87e0a42fefce8815f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-180301
Malicious code in astro-photon-publish-blazar npm...
Malicious code in nova-astro-playwright-mira (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be6aa5807609425f2a33e522f29ae44baadab83adcc49c1bc3035527e455cbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179369
Malicious code in deimos-ceres-astro-isostasy npm...
EUVD-2025-176014
Malicious code in terraforming-astro-virgo-toml npm...
Astro cross-site scripting vulnerabilities
Astro is a web framework for content-driven websites in the Astro open source. A cross-site scripting vulnerability exists in Astro versions 5.2.0 through prior to 5.15.6, which stems from a reflective cross-site scripting vulnerability in the development server error page that could lead to the...
CVE-2025-64525: Server-Side Request Forgery (SSRF)
Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are:...
CVE-2025-64745: Improper Neutralization of Input During Web Page Generation
Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes ...
PT-2025-46860
Name of the Vulnerable Software and Affected Versions Astro versions 2.16.0 through 5.15.4 Description Astro, a web framework, contains a flaw in its on-demand rendering feature where the x-forwarded-proto and x-forwarded-port request headers are used without proper sanitization when constructing...
PT-2025-46907
Name of the Vulnerable Software and Affected Versions Astro versions 5.2.0 through 5.15.6 Description A Reflected Cross-Site Scripting XSS vulnerability exists in Astro’s development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScrip...
Astro code issues and vulnerabilities
Astro is an Astro open source web framework for content-driven websites. A code issue vulnerability exists in Astro versions 2.16.0 through prior to 5.15.5, which stems from the unsafe use of the x-forwarded-proto and x-forwarded-port request headers, which could lead to middleware protection rou...
MAL-2025-170925 Malicious code in astroadventurer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85af7a4c178495c52bdee91250293622a607c820df06dcddbb517f1040cf07c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...