VulnerabilityAnalyzed

CVE-2025-64764

Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s).

MEDIUM 5.4EPSS 0.49%

Does this matter?

Lower severity and a low EPSS score (0.49%). Track it; it rarely justifies an emergency change on its own.

Description

Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS: 0.49% probability · 41th percentile
CISA KEV: Not listed
Weakness: CWE-80
Affected: astro/astro
Source: security-advisories@github.com

References

https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91Patch
https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.