@volpe/astro-utils (>=0.0.1, <=0.0.20), astro-npm-loader (>=0.0.1, <=0.1.2) potentially affected by CVE-2024-56159 via astro (5.0.0-beta.5)

astro NPM version 5.0.0-beta.5 is affected by a known vulnerability. The following packages have a transitive dependency on astro and may be impacted: - @volpe/astro-utils =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2024-56159 Source advisory: MEND:CVE-2024-56159...

CVE-2024-56159 Server source code is exposed to the public if sourcemaps are enabled

Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files for the server code are moved to a publicly-accessible...

CVE-2024-56159

Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files for the server code are moved to a publicly-accessible...

CVE-2024-56159 Server source code is exposed to the public if sourcemaps are enabled

Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files for the server code are moved to a publicly-accessible...

CVE-2024-56159 Server source code is exposed to the public if sourcemaps are enabled

Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files for the server code are moved to a publicly-accessible...

CVE-2024-56159

Astro CVE-2024-56159 describes an information-disclosure vulnerability where sourcemap files for server code are published publicly during build, enabling unauthenticated access to server source. Affected: server-output (SSR) projects on Astro 5.x from 5.0.3–5.0.7 with sourcemaps enabled; fix rel...

@bookshop/browser (3.11.0-rc.0), @bookshop/generate (3.11.0-rc.0) +25 more potentially affected by CVE-2024-56159 via astro (>=4.0.0, <=4.16.17)

astro NPM version =4.0.0, =0.40.5, =0.38.0, =0.38.0, =2.8.4, =0.2.0, =0.1.0, =0.0.0-dev-20231211183354, =0.0.3, =0.0.3, =0.0.5, =0.0.1, =1.0.2, =1.0.9 and more Source cves: CVE-2024-56159 Source advisory: GHSA-49W6-73CW-CHJR...

@volpe/astro-utils (>=0.0.1, <=0.0.20), astro-npm-loader (>=0.0.1, <=0.1.2) potentially affected by CVE-2024-56159 via astro (5.0.0-beta.5)

astro NPM version 5.0.0-beta.5 is affected by a known vulnerability. The following packages have a transitive dependency on astro and may be impacted: - @volpe/astro-utils =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2024-56159 Source advisory: GHSA-49W6-73CW-CHJR...

@bookshop/browser (3.11.0-rc.0), @bookshop/generate (3.11.0-rc.0) +25 more potentially affected by CVE-2024-56159 via astro (>=4.0.0, <=4.16.17)

astro NPM version =4.0.0, =0.40.5, =0.38.0, =0.38.0, =2.8.4, =0.2.0, =0.1.0, =0.0.0-dev-20231211183354, =0.0.3, =0.0.3, =0.0.5, =0.0.1, =1.0.2, =1.0.9 and more Source cves: CVE-2024-56159 Source advisory: OSV:GHSA-49W6-73CW-CHJR...

@volpe/astro-utils (>=0.0.1, <=0.0.20), astro-npm-loader (>=0.0.1, <=0.1.2) potentially affected by CVE-2024-56159 via astro (5.0.0-beta.5)

astro NPM version 5.0.0-beta.5 is affected by a known vulnerability. The following packages have a transitive dependency on astro and may be impacted: - @volpe/astro-utils =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2024-56159 Source advisory: OSV:GHSA-49W6-73CW-CHJR...

PT-2024-36726

Name of the Vulnerable Software and Affected Versions Astro versions v5.0.3 through v5.0.7 Astro versions 4.16.17 and earlier Astro versions 5.0.8 and earlier Description A flaw exists in the build process of Astro, a web framework for content-driven websites, allowing unauthenticated users to...

CVE-2024-56159: Storage of File with Sensitive Data Under Web Root

Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files for the server code are moved to a publicly-accessible...

Astro security vulnerabilities

Astro is an Astro open source web framework for content-driven websites. A security vulnerability exists in Astro versions 5.0.7 and earlier and 4.16.17 and earlier, which stems from a server code sourcemap file being moved to a publicly accessible folder, which allows an unauthenticated user to...

CVE-2024-56140

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

CVE-2024-56140 Bypass of CSRF Middleware in Astro

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

CVE-2024-56140 Bypass of CSRF Middleware in Astro

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

CVE-2024-56140

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the "security.checkOrigin" configuration option is set to "true", Astro middleware will perform a CSRF check. However, a vulnerability...

CVE-2024-56140 Bypass of CSRF Middleware in Astro

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

@ampt/astro (0.0.1-beta.1), @asherng/css-ui (>=0.0.17, <=0.0.18) +203 more potentially affected by CVE-2024-56140 via astro (>=0.20.12, <=4.16.16)

astro NPM version =0.20.12, =0.0.17, =0.0.2, =0.0.1, =0.2.0, =0.0.1, =0.1.30, =1.0.0, =1.0.0, =3.6.0-beta.0, =3.10.1 - @bookshop/browser 3.11.0-rc.0 - @bookshop/generate 3.11.0-rc.0 and more Source cves: CVE-2024-56140 Source advisory: MEND:CVE-2024-56140...

CVE-2024-56140

CVE-2024-56140 affects the Astro CSRF-protection middleware. A semicolon-delimited parameter after the Content-Type (e.g., application/x-www-form-urlencoded; abc) causes the request to be treated as a simple request, bypassing preflight validation and CSRF checks when security.checkOrigin is true...