CVE-2025-64764

Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91	Patch
https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Astro es un framework web. Versiones anteriores a la versión 5.15.8, una vulnerabilidad de XSS Reflejado está presente cuando la característica de islas del servidor se utiliza en la aplicación objetivo, independientemente de lo que se pretendía con la(s) plantilla(s) del componente. Este problema ha sido parcheado en la versión 5.15.8.

Information

Published : 2025-11-19 17:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64764

Mitre link : CVE-2025-64764

CVE.ORG link : CVE-2025-64764

JSON object : View

Products Affected

astro

astro

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2025-64764", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64764", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T21:06:04.095169Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "withastro", "product": "astro", "versions": [{"status": "affected", "version": "< 5.15.8"}]}]}], "published": "2025-11-19T17:15:52.647", "references": [{"url": "https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8."}, {"lang": "es", "value": "Astro es un framework web. Versiones anteriores a la versi\u00f3n 5.15.8, una vulnerabilidad de XSS Reflejado est\u00e1 presente cuando la caracter\u00edstica de islas del servidor se utiliza en la aplicaci\u00f3n objetivo, independientemente de lo que se pretend\u00eda con la(s) plantilla(s) del componente. Este problema ha sido parcheado en la versi\u00f3n 5.15.8."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "1015DFA8-9106-453C-9144-11E63ADA3B67", "versionEndExcluding": "5.15.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}