CVE-2025-64745
Description
Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this vulnerability only affects the development server and not production builds, it could be exploited to compromise developer environments through social engineering or malicious links. Version 5.15.6 fixes the issue.
How to fix
- astro astro5.15.6 or later
- astro5.15.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| astro astro | 5.2.0 ≤ v < 5.15.6 | 5.15.6 |
| astronpm | 5.2.0 ≤ v < 5.15.6 | 5.15.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.