[ Vendor · 4 CVEs ]
withastro
CVEs affecting withastro published in the last 30 days, plus any withastro CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114127 | 21 Oct 2026 | CVSS 2.3 | Astro: Arbitrary CSS injection in Astro View TransitionsAstro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string… | Fix |
| CVE-2026-114128 | 21 Oct 2026 | CVSS 6.5 | Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingAstro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and… | Fix |
| CVE-2026-102984 | 30 Sep 2026 | CVSS 8.2 | Astro: Malformed port in the Host header can crash the Node adapterAstro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a… | Fix |
| CVE-2026-102983 | 30 Sep 2026 | CVSS 6.3 | Astro: Netlify Image CDN allowlist bypass enables SSRFAstro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify… | Fix |