Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91 Patch
- https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.4 · astroNVD modified 2026-10-18 20:10
Affected (CPE criteria) 1
cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*