CVE-2025-64764

Astro is vulnerable to Reflected XSS via the server islands feature

State: Published
Severity: 7.1 High
Published: Nov 19, 2025
Updated: Nov 19, 2025
Reserved: Nov 10, 2025

Description

Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N	GitHub_M

Weaknesses

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Affected Products

Product	Versions
astrowithastro	< 5.15.8Affected

References

https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723
https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.