CVE-2024-47885
Description
The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting (XSS) in websites enables Astro's client-side routing and has *stored* attacker-controlled scriptless HTML elements (i.e., `iframe` tags with unsanitized `name` attributes) on the destination pages. This vulnerability can result in cross-site scripting (XSS) attacks on websites that built with Astro that enable the client-side routing with `ViewTransitions` and store the user-inserted scriptless HTML tags without properly sanitizing the `name` attributes on the page. Version 4.16.1 contains a patch for this issue.
How to fix
- astro astro4.16.1 or later
- astro4.16.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| astro astro | 3.0.0 ≤ v < 4.16.1 | 4.16.1 |
| astronpm | 3.0.0 ≤ v < 4.16.1 | 4.16.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.