CVSS 4.0
6.9 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NCVE-2025-55303
Medium (6.9) in astro astro. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in astro 4.16.19, 5.13.2.
Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include an /_image endpoint which returns optimized versions of images. A bug in impacted versions of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. /_image?href=//example.com/image.png. This vulnerability is fixed in 5.13.2 and 4.16.18.
Severity
CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-79, CWE-115
- Published
- Modified
- Record from
- the NVD, synced
Affected
- astro:astro
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xf8x-j4p2-f749 | npm | astro | >=5.0.0-alpha.0 <5.13.2 | 5.13.2 |
| GHSA-xf8x-j4p2-f749 | npm | @astrojs/node | <9.1.1 | 9.1.1 |
| GHSA-xf8x-j4p2-f749 | npm | astro | <4.16.19 | 4.16.19 |