Malicious code in spectron-webdriver-deimos-astro-sync (npm)

The package spectron-webdriver-deimos-astro-sync was found to contain malicious code...

MAL-2025-43523 Malicious code in astro-postcss-loader-grunt-selenium (npm)

The package astro-postcss-loader-grunt-selenium was found to contain malicious code...

MAL-2025-45300 Malicious code in neutronstar-grunt-quantum-computing-astro (npm)

The package neutronstar-grunt-quantum-computing-astro was found to contain malicious code...

Malicious code in proxima-ignite-astro-protoplanetarydisk (npm)

The package proxima-ignite-astro-protoplanetarydisk was found to contain malicious code...

Malicious code in astro-mantle-accretion-deimos (npm)

The package astro-mantle-accretion-deimos was found to contain malicious code...

MAL-2025-46125 Malicious code in spectron-webdriver-deimos-astro-sync (npm)

The package spectron-webdriver-deimos-astro-sync was found to contain malicious code...

MAL-2025-43525 Malicious code in astrobiology-config-ablation-astro (npm)

The package astrobiology-config-ablation-astro was found to contain malicious code...

MAL-2025-45799 Malicious code in remark-exoplanetology-meissa-astro (npm)

The package remark-exoplanetology-meissa-astro was found to contain malicious code...

Malicious code in astro-postcss-loader-grunt-selenium (npm)

The package astro-postcss-loader-grunt-selenium was found to contain malicious code...

Malicious code in remark-exoplanetology-meissa-astro (npm)

The package remark-exoplanetology-meissa-astro was found to contain malicious code...

MAL-2025-43524 Malicious code in astro-sagitta-exobiology-html-webpack-plugin (npm)

The package astro-sagitta-exobiology-html-webpack-plugin was found to contain malicious code...

Malicious code in astro-sagitta-exobiology-html-webpack-plugin (npm)

The package astro-sagitta-exobiology-html-webpack-plugin was found to contain malicious code...

MAL-2025-43623 Malicious code in bionics-astro-prompts-meteor (npm)

The package bionics-astro-prompts-meteor was found to contain malicious code...

MAL-2025-45614 Malicious code in proxima-ignite-astro-protoplanetarydisk (npm)

The package proxima-ignite-astro-protoplanetarydisk was found to contain malicious code...

MAL-2025-43522 Malicious code in astro-mantle-accretion-deimos (npm)

The package astro-mantle-accretion-deimos was found to contain malicious code...

Astro 代码问题漏洞

Astro is an Astro open source web framework for content-driven websites. A code issue vulnerability exists in Astro versions 11.0.3 through 12.6.5 that stems from the presence of SSRF in the Cloudflare adapter, which could allow bypassing third-party domain restrictions...

CVE-2025-58179 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...

CVE-2025-58179 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...

CVE-2025-58179

Astro exposes an SSRF flaw in versions 11.0.3–12.6.5 when using the Cloudflare adapter with output: 'server' and the default imageService: 'compile'. The image optimization endpoint does not validate received URLs, enabling content from unauthorized third-party domains to be served. Root cause: a...

GHSA-QPR4-C339-7VQ8 Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter

Summary When using Astro's Cloudflare adapter @astrojs/cloudflare configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served...