IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-08-19 19:15

MODIFIED

2025-08-20 14:40

EPSS (Prob. Exploit)

0.64%

Top 50.1%

🎯 NUCLEI TEMPLATE

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 NUCLEI 🔗 2026-11-08

> DESCRIPTION

Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include an /_image endpoint which returns optimized versions of images. A bug in impacted versions of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. /_image?href=//example.com/image.png. This vulnerability is fixed in 5.13.2 and 4.16.18.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-xf8x-j4p2-f749 MODERATE

Astro allows unauthorized third-party images in _image endpoint

AFFECTED PACKAGES:

NPM / astro

>= 5.0.0-alpha.0, < 5.13.2

Fixed in: 5.13.2

NPM / astro

<= 4.16.18

Fixed in: 4.16.19

NPM / @astrojs/node

<= 9.1.0

Fixed in: 9.1.1

> NUCLEI TEMPLATES

Des templates Nuclei sont disponibles pour scanner cette vulnérabilité.

🎯

CVE-2025-55303.yaml

http/cves/2025/CVE-2025-55303.yaml

Usage: nuclei -t http/cves/2025/CVE-2025-55303.yaml -u target.com

> HISTORIQUE DES MODIFICATIONS

Première apparition

19/08/2025 19:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:07

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui