https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:24:00.110531+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-250210 EUVD-2026-250210 2026-10-06T22:24:00.161462+00:00 EUVD-2026-250210 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55303 fkie_cve-2025-55303 2026-10-06T22:24:00.161500+00:00

Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include an /_image endpoint which returns optimized versions of images. A bug in impacted versions of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. /_image?href=//example.com/image.png. This vulnerability is fixed in 5.13.2 and 4.16.18.

 https://cve.radiocsirt.org/vuln/ghsa-xf8x-j4p2-f749 GHSA-xf8x-j4p2-f749 — Astro allows unauthorized third-party images in _image endpoint 2026-10-06T22:24:00.161534+00:00

Affected: npm: astro, npm: @astrojs/node

### Summary

In affected versions of `astro`, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served.

### Details

On-demand rendered sites built with Astro include an `/_image` endpoint which returns optimized versions of images.

The `/_image` endpoint is restricted to processing local images bundled with the site and also supports remote images from domains the site developer has manually authorized (using the [`image.domains`](https://docs.astro.build/en/reference/configuration-reference/#imagedomains) or [`image.remotePatterns`](https://docs.astro.build/en/reference/configuration-reference/#imageremotepatterns) options).

However, a bug in impacted versions of `astro` allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. `/_image?href=//example.com/image.png`.

### Proof of Concept

1. Create a new minimal Astro project (`astro@5.13.0`).

2. Configure it to use the Node adapter (`@astrojs/node@9.1.0` — newer versions are not impacted):

```js // astro.config.mjs import { defineConfig } from 'astro/config'; import node from '@astrojs/node';

export default defineConfig({ adapter: node({ mode: 'standalone' }), }); ```

3. Build the site by running `astro build`.

4. Run the server, e.g. with `astro preview`.

5. Append `/_image?href=//placehold.co/600x400` to the preview URL, e.g. <http://lo…