PT-2025-47488 · Astro · Astro

Published 2025-11-19 · Updated 2026-05-13 · CVE-2025-64764

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Astro versions prior to 5.15.8

Description A reflected cross-site scripting (XSS) issue exists in Astro when the server islands feature is utilized. The issue affects applications using the server islands feature, regardless of the component template's intended behavior.

Recommendations Update to version 5.15.8 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-64764

GHSA-WRWG-2HG8-V723

Affected Products

Astro

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64764.json · Exploit
• https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91 · Patch
• https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64764 · Security Note
• https://t.me/CVEtracker/37751 · Telegram Post
• https://twitter.com/CVEnew/status/1991187278467903510 · Twitter Post
• https://twitter.com/dailycve/status/2054389668053975057 · Twitter Post
• https://twitter.com/zhero___/status/1991179625876087288 · Twitter Post