CVE Explorer

CVE-2025-65019

Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections. This issue has been patched in version 5.15.9.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:45d20f333d42805aa172435a9434974c111396a827b7a6b20f86be10fe2e88fe

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"astro","vendor":"withastro","versions":[{"status":"affected","version":"< 5.15.9"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1cfc0066e9cab7f6910c984aa212ce1d85274de77db6afa4a3b0e9ccd40bd0dc · sha256:09cd995a3bb513d7… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:1cfc0066e9cab7f6910c984aa212ce1d85274de77db6afa4a3b0e9ccd40bd0dc · sha256:09cd995a3bb513d7… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:1cfc0066e9cab7f6910c984aa212ce1d85274de77db6afa4a3b0e9ccd40bd0dc · sha256:09cd995a3bb513d7… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"name":"https://github.com/withastro/astro/commit/9e9c528191b6f5e06db9daf6ad26b8f68016e533","tags":["x_refsource_MISC"],"url":"https://github.com/withastro/astro/commit/9e9c528191b6f5e06db9daf6ad26b8f68016e533"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1cfc0066e9cab7f6910c984aa212ce1d85274de77db6afa4a3b0e9ccd40bd0dc · sha256:09cd995a3bb513d7… · /containers/cna/references/1

{"name":"https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q","tags":["x_refsource_CONFIRM"],"url":"https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1cfc0066e9cab7f6910c984aa212ce1d85274de77db6afa4a3b0e9ccd40bd0dc · sha256:09cd995a3bb513d7… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer