CVE-2025-65019CWE-79cross-site-scripting

CVE-2025-65019

Medium · published November 19, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
18.8
In the wild
Unconfirmed
What it is

Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections. This issue has been patched in version 5.15.9.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00274 · 18.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-19T22:15Z
Affected products (1)
ProductVersionsFixed in
astro/astro< 5.15.95.15.9
References (2)
https://github.com/withastro/astro/commit/9e9c528191b6f5e06db9daf6ad26b8f68016e533 · [email protected]https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q · [email protected]
EPSS history
Timeline
  • 19 NOV 16:40Z
    Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint
    cvelistv5