Vulnerability · Published Nov 19, 2025 · Assigned by GitHub_M
CVE-2025-64764Astro is vulnerable to Reflected XSS via the server islands feature
High 7.1
In plain English
A high-severity security flaw in astro from withastro. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.5%top 55.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | astro | 5.15.8 | GHSA-wrwg-2hg8-v723 |
Affected products (as reported)
Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N