Website

The New Oil Mission Statement To educate readers on why privacy and security matter, and the various tools and techniques available to help them reclaim and protect their own privacy & security To empower readers to believe that privacy and security are attainable for everyone and to do their bes...

Astro Cloudflare Adapter - Server Side Request Forgery

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...

Astro - Unauthorized Third-Party Image Access

Astro 5.13.2 and 4.16.18 contains an information disclosure vulnerability caused by improper validation of protocol-relative URLs in the image optimization endpoint, letting attackers serve images from unauthorized third-party domains, exploit requires on-demand rendering deployment. id:...

Astro SSR - Server-Side Request Forgery

Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...

Astro - Information Disclosure

Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enable...

Astro SSR - Open Redirect

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. id: CVE-2025-54793...

CVE-2024-56924

CVE-2024-56924 Vulnerability Description A Cross-Site Request Forgery CSRF vulnerability exists in the code astro Internet Banking System version 2.0.0, which allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as administrators, without their knowledge...

GHSA-MH32-JXCR-MH9F Astro: XSS via attribute injection in dynamic tag names

Summary When a dynamic tag const Tag = ...; resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle /. Because HTML parsers treat / inside a tag as an attribute separator, a tag name...

EUVD-2026-124742

Astro: XSS via attribute injection in dynamic tag names...

npm: Astro: XSS via attribute injection in dynamic tag names

npm: Astro: XSS via attribute injection in dynamic tag names vulnerability discovered by ? in WordPress npm astro versions = 7.4.4...

Astro: XSS via attribute injection in dynamic tag names

Summary When a dynamic tag const Tag = ...; resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle /. Because HTML parsers treat / inside a tag as an attribute separator, a tag name...

GHSA-R3H5-4585-7X3W Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

Summary The /image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems such as Linux, a directory whose path differs from the...

Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

Summary The /image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems such as Linux, a directory whose path differs from the...

EUVD-2026-124748

Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems...

npm: Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

npm: Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems vulnerability discovered by ? in WordPress npm astro versions = 5.14.3, = 7.4.6...

CVE-2025-58179-Check

CVE-2025-58179-Check CVE-2025-58179-Check is a simple Python script to verify SSRF Server-Side Request Forgery / Content Spoofing vulnerability on the /image endpoint in the Astro framework. This vulnerability is tracked as GHSA-qpr4-c339-7vq8 and CVE-2025-58179. Vulnerability Background This...

astro_CVE-2026-33532

Astro Starter Kit: Minimal npm create astro@latest -- --template minimal 🧑‍🚀 Seasoned astronaut? Delete this file. Have fun! 🚀 Project Structure Inside of your Astro project, you'll see the following folders and files: / ├── public/ ├── src/ │ └── pages/ │ └── index.astro └── package.json Astro...

CVE-2026-126364

Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory...

CVE-2026-126361

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

CVE-2026-126363

Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and...