By vendor
Astro vulnerabilities
Known CVEs affecting Astro products, prioritized by severity, with SEC.co remediation and detection guidance.
3 published vulnerabilities
- CVE-2026-54299HIGH 7.5
Astro, a modern web framework, has a vulnerability in its server-side rendering (SSR) feature when prerendered error pages are enabled. When an error occurs at runtime, Astro fetches prerendered 404 or 500 error pages over HTTP. The problem: it constructs the fetch URL using the Host header from the incoming request without validating it against a whitelist of allowed domains. An attacker can craft a malicious Host header to redirect this fetch to a server they control, potentially allowing them to read sensitive response content. This affects Astro versions before 6.4.6.
- CVE-2026-50146HIGH 7.1
Astro, a popular web framework, contains a reflected cross-site scripting (XSS) vulnerability in versions before 6.3.3. When components use client-side directives, Astro fails to properly escape slot names before inserting them into HTML attributes. An attacker can exploit this by crafting a malicious slot name that breaks out of the attribute context and injects arbitrary HTML code. The vulnerability occurs during server-side rendering (SSR), meaning the injected content is reflected back to users without proper sanitization, allowing attackers to steal session tokens, redirect users, or perform actions on their behalf.
- CVE-2026-54298MEDIUM 4.2
Astro, a popular web framework, contains a vulnerability in how it processes HTML attributes during server-side rendering. When developers use the spread syntax to pass object properties as HTML attributes—a common pattern for dynamic content—Astro fails to escape keys coming from untrusted sources like APIs or user input. An attacker can craft malicious property names that become unescaped HTML attributes, allowing them to inject event handlers (onclick, onmousemove) or break out of the attribute context entirely to inject new HTML elements. This affects Astro versions before 6.4.6.