PT-2026-22062 · Snowflake · Astro

Pho9Ubenaa · Published 2026-02-25 · Updated 2026-03-09 · CVE-2026-27829

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Astro versions 9.0.0 through 9.5.3

Description Astro’s image pipeline contains a flaw that allows bypassing image.domains / image.remotePatterns restrictions, enabling the server to fetch content from unauthorized remote hosts. The inferSize option, used to determine image dimensions at render time, does not perform domain validation when active, allowing image fetches from any host regardless of configured restrictions. An attacker influencing the image URL, such as through CMS content or user-supplied data, can cause the server to fetch from arbitrary hosts, potentially leading to server-side request forgery (SSRF) against internal network services and cloud metadata endpoints. The API endpoint used for image fetching is not explicitly mentioned. The variable src within the getImage function is used to specify the image URL.

Recommendations Update to Astro version 9.5.4 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-27829

GHSA-CJ9F-H6R6-4CX2

Affected Products

Astro

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27829.json · Exploit
• https://github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2 · Vendor Advisory
• https://github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9 · Patch
• https://osv.dev/vulnerability/GHSA-cj9f-h6r6-4cx2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27829 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27829 · Vendor Advisory
• https://github.com/withastro/astro · Note
• https://twitter.com/CVEnew/status/2027004241416470719 · Twitter Post
• https://t.me/cveNotify/154878 · Telegram Post
• https://t.me/cveNotify/153276 · Telegram Post