astro

Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Latest 7.4.0

94%

Total Score

healthy

Frequent releases, active development, organization backing, and attested builds outweigh minor workflow hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 22 workflows were analyzed, all 75 action references are pinned, and no untrusted checkout or script-injection paths were found. The high-confidence template-injection and medium-confidence secrets-inherit findings are workflow hygiene concerns, but neither is independently evidence of an unsafe package release.

Vulnerabilities

Title	Versions	Severity
CVE-2026-84376 astro is vulnerable to Partial String Comparison in versions 0.0.0 - 7.2.3.	0.0.0 - 7.2.3	Medium
AIKIDO-2026-219768 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. astro is vulnerable to Authorization Bypass in versions 6.4.4 - 7.1.0.	6.4.4 - 7.1.0	Medium
CVE-2026-59729 astro is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 7.0.6.	0.0.0 - 7.0.6	Medium
CVE-2026-59727 astro is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 3.10.0 - 7.0.4.	3.10.0 - 7.0.4	Low
CVE-2026-73423 astro is vulnerable to Cross-Site Request Forgery (CSRF) in versions 7.0.0 - 7.0.6.	7.0.0 - 7.0.6	Medium