PT-2026-41940 · Astro · Astro

Published 2026-05-19 · Updated 2026-05-20 · CVE-2026-30117

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions scalar/astro version 0.1.13

Description An arbitrary file upload issue exists in the Scalar Proxy endpoint via the scalar url query parameter. This allows attackers to execute arbitrary code by uploading a specially crafted SVG file (Scalable Vector Graphics, an XML-based vector image format).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-30117

Affected Products

Astro

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-30117 · Security Note
• https://t.me/cveNotify/164244 · Telegram Post
• https://twitter.com/CVEnew/status/2056994216841187641 · Twitter Post
• https://github.com/prassan10/XSS-Open-Redirect-via-scalar_url · Note