PT-2026-27488 · Astro · Astro

Christos-Eth · Publicado 2026-03-24 · Atualizado 2026-03-26 · CVE-2026-33769

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Astro versions 2.10.10 through 5.18.0

Description Astro’s remotePatterns path enforcement for remote URLs used by server-side fetchers, such as the image optimization endpoint, is affected by an issue. The path matching logic for /* wildcards is unanchored, allowing a pathname containing the allowed prefix later in the path to still match. This can allow an attacker to fetch paths outside the intended allowlisted prefix on an otherwise allowed host.

Recommendations Update to version 5.18.1 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-183

Identificadores relacionados

CVE-2026-33769

GHSA-G735-7G2W-HH3F

Produtos afetados

Astro

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33769.json · Exploit
• https://github.com/withastro/astro · Nota
• https://github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33769 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2036545816773492913 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-g735-7g2w-hh3f · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33769 · Nota de Segurança