{"id":"CVE-2026-54300","revision":"346ef3a77aba48aaad8623610a34339a","records":[{"revision":"346ef3a77aba48aaad8623610a34339a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54300","aliases":[],"title":"@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config","description":"@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader semantics than Astro's canonical matcher. A single wildcard hostname such as *.example.com is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as /ok/* is converted without end anchoring, so deeper paths match by prefix. This vulnerability is fixed in 7.0.13.","state":0,"publishedAt":"2026-06-22T17:30:49.447+00:00","modifiedAt":"2026-06-23T14:08:54.167+00:00","affected":[{"ecosystem":"Vendor product","name":"astro","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"withastro\",\n                    \"product\": \"astro\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.0.13\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/withastro/astro/security/advisories/GHSA-529g-xq4f-cw38"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54300","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54300","identifiers":["CVE-2026-54300"]},"retained":false,"historicalAffected":[]}],"coverage":[]}