AIKIDO-2024-10192

astro is vulnerable to Cross-site Scripting (XSS)

Cross-site Scripting (XSS) Pre-CVE Published Jul 19, 2024

Low Risk

This Affects:

astro

3.3.0 - 4.12.1

Fixed in 4.12.2

Are you affected? Scan for Free

TL;DR

Affected versions of the package are vulnerable to Cross-site Scripting (XSS) in the experimental server islands feature.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

astro is vulnerable to Cross-site Scripting (XSS) in versions 3.3.0 - 4.12.1.

How to fix this

Upgrade the astro library to the patch version.

Low Risk

This Affects:

astro

3.3.0 - 4.12.1

Fixed in 4.12.2

Are you affected? Scan for Free

Links

github.com/withastro/astro/releases/tag/astro%404.12.2

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Scan for Free

Book a Demo

Free. No credit card required.

Company

Resources

Industries

Use Cases

Compare

Legal

Connect

hello@aikido.dev

Security

Stay up to date with all updates

I consent to receiving marketing communications based on Aikido’s Privacy Policy.

LinkedIn YouTube X

Keizer Karelstraat 15, 9000, Ghent, Belgium

95 Third St, 2nd Fl, San Francisco, CA 94103, US

Unit 6.15 Runway East 18 18 Crucifix Ln, London SE1 3JW UK

Ghent, Belgium | San Francisco, US