astro@0.0.0-clean-sm-20241216182429 vulnerabilities

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Relative Path Traversal via the href parameter in the image optimization endpoint during development mode. An attacker can access arbitrary local image files readable by the Node.js process by sending crafted HTTP requests specifying absolute file paths.

Upgrade astro to version 5.14.3 or higher.

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /_server-islands/[name] endpoint when handling the e, s and p parameters. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious payloads into one of the parameters, which are rendered as a child of a tag whose name is derived from the absolute path of the island file.

Upgrade astro to version 5.15.8 or higher.

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the x-forwarded-proto and x-forwarded-port headers due to improper input sanitization when constructing URLs. An attacker can bypass path-based middleware protections, poison caches, or perform server-side requests by manipulating these headers.

Note:

This is also a bypass of the fix for CVE-2025-61925.

Upgrade astro to version 5.15.5 or higher.

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') via the X-Forwarded-Host header when using the Astro.url property without validation. An attacker can manipulate output content and potentially cause users to be redirected to malicious sites, allowing login credentials theft by sending crafted headers.

Note:

1. This is only exploitable if the application is deployed in on-demand/dynamic rendering mode.

2. In case of using a caching proxy, any page which is cached could persist the malicious value for subsequent users.

Upgrade astro to version 5.14.3 or higher.

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /_image endpoint. An attacker can cause loading of unauthorized third-party images, including potentially malicious SVG files, to be served by bypassing domain restrictions using protocol-relative URLs. This can lead to the execution of arbitrary scripts in the context of the affected site if a user follows a crafted link.

Note: This vulnerability is only exploitable in projects using the @astrojs/node adapter and on-demand rendering.

Upgrade astro to version 4.16.19, 5.13.2 or higher.

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Storage of File with Sensitive Data Under Web Root due to the exposure of sourcemap files in publicly accessible directories during the build process. An attacker can access and reconstruct server-side source code by making unauthorized HTTP GET requests to the server hosting the website.

Note:

This is only exploitable if sourcemaps are enabled.

Upgrade astro to version 4.16.18, 5.0.8 or higher.

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the function createOriginCheckMiddleware due to improper validation of the content-type header

Upgrade astro to version 4.16.17 or higher.