WI
Vendor
withastro
30
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114128 New | AS astro withastro | 6.5 | Oct 21 | Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering |
| CVE-2026-114127 New | AS astro withastro | 2.3 | Oct 21 | Astro: Arbitrary CSS injection in Astro View Transitions |
| CVE-2026-102984 | AS astro withastro | 8.2 | Sep 30 | Astro: Malformed port in the Host header can crash the Node adapter |
| CVE-2026-102983 | AS astro withastro | 6.3 | Sep 30 | Astro: Netlify Image CDN allowlist bypass enables SSRF |
| CVE-2026-84376 | AS astro withastro | 6.3 | Sep 2 | Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base |
| CVE-2026-73424 | AS astro withastro | 6.5 | Aug 17 | Astro: Unauthenticated path override in the @astrojs/vercel ISR function |
| CVE-2026-73425 | AS astro withastro | 3.7 | Aug 12 | @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped |
| CVE-2026-73423 | AS astro withastro | 5.1 | Aug 12 | Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered |
| CVE-2026-73422 | AS astro withastro | 5.3 | Aug 12 | Astro: Reflected XSS via unescaped View Transition animation properties |
| CVE-2026-59730 | AS astro withastro | 2.1 | Jul 27 | @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect |
| CVE-2026-59728 | AS astro withastro | 4.3 | Jul 27 | @astrojs/rss: XML Injection via Unescaped RSS Feed Fields |
| CVE-2026-59727 | AS astro withastro | 2.1 | Jul 27 | Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands |
| CVE-2026-59729 | AS astro withastro | 5.1 | Jul 27 | Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) |
| CVE-2026-59731 | AS astro withastro | 8.2 | Jul 8 | Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch |
| CVE-2026-54299 | AS astro withastro | 7.5 | Jun 22 | Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) |
| CVE-2026-54298 | AS astro withastro | 6.1 | Jun 22 | Astro: XSS via Unescaped Attribute Names in Spread Props |
| CVE-2026-50146 | AS astro withastro | 6.1 | Jun 22 | Astro: Reflected XSS via unescaped slot name |
| CVE-2026-54300 | AS astro withastro | 5.3 | Jun 22 | @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config |
| CVE-2026-45028 | AS astro withastro | 6.1 | May 13 | Astro: Server island encrypted parameters vulnerable to cross-component replay |
| CVE-2026-41322 | AS astro withastro | 5.3 | Apr 24 | @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed |
| CVE-2026-41321 | AS @astrojs/cloudflare withastro | 2.2 | Apr 24 | @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint |
| CVE-2026-41067 | AS astro withastro | 6.1 | Apr 24 | Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass |
| CVE-2026-33769 | AS astro withastro | 5.3 | Mar 24 | Astro: Remote allowlist bypass via unanchored matchPathname wildcard |
| CVE-2026-33768 | AS astro withastro | 9.1 | Mar 24 | Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` |
| CVE-2026-29772 | AS astro withastro | 7.5 | Mar 24 | Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands |
| CVE-2026-27829 | AS astro withastro | 7.2 | Feb 26 | Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize |
| CVE-2026-27729 | AS astro withastro | 7.5 | Feb 24 | Astro has memory exhaustion DoS due to missing request body size limit in Server Actions |
| CVE-2026-25545 | AS astro withastro | 8.6 | Feb 24 | Astro has Full-Read SSRF in error rendering via Host: header injection |
| CVE-2024-56159 | AS astro withastro | 5.3 | Dec 19 | Server source code is exposed to the public if sourcemaps are enabled |
| CVE-2024-56140 | AS astro withastro | 6.5 | Dec 18 | Bypass of CSRF Middleware in Astro |