Skip to content
OpenAdvisories

Package · npm

astro

29 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-114127

    Astro: Arbitrary CSS injection in Astro View Transitions

    Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data …

    withastro astro astro npm
  • Low 2.1
    CVE-2026-59727

    Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

    Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value o…

    withastro astro astro npm
  • Low 2.9
    CVE-2026-45028

    Astro: Server island encrypted parameters vulnerable to cross-component replay

    Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker…

    withastro astro astro npm
  • Low 2.9
    CVE-2026-33769

    Astro: Remote allowlist bypass via unanchored matchPathname wildcard

    Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards…

    withastro astro astro npm
  • Low 3.5
    CVE-2025-64757

    Astro Development Server is Vulnerable to Arbitrary Local File Read

    Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro developmen…

    withastro astro astro npm
  • Low 2.7
    CVE-2025-64745

    Astro development server error page vulnerable to reflected Cross-site Scripting

    Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can injec…

    withastro astro astro npm