{"cve":"CVE-2025-64745","nvd":{"published":"2025-11-13T21:15:54.240","modified":"2026-10-18T20:10:00.110","status":"Analyzed","description":"Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this vulnerability only affects the development server and not production builds, it could be exploited to compromise developer environments through social engineering or malicious links. Version 5.15.6 fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/withastro/astro/blob/5bc37fd5cade62f753aef66efdf40f982379029a/packages/astro/src/template/4xx.ts#L133-L149","https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91","https://github.com/withastro/astro/pull/12994","https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7"],"products":["astro:astro"],"source":"nvd","synced_at":"2026-10-19T22:16:02.354564667+00:00"},"epss":{"cve":"CVE-2025-64745","score":0.00262,"percentile":0.17886,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-w2vj-39qv-7vh7","url":"https://osv.dev/vulnerability/GHSA-w2vj-39qv-7vh7","summary":"Astro development server error page is vulnerable to reflected Cross-site Scripting","modified":"2025-11-27T08:22:31.471739Z","packages":[{"ecosystem":"npm","name":"astro","purl":"pkg:npm/astro","ranges":[">=5.2.0 <5.15.6"],"fixed":["5.15.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}