{"id":"CVE-2026-73423","sourceIdentifier":"security-advisories@github.com","published":"2026-08-12T21:17:41.340","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6."},{"lang":"es","value":"Astro es un framework web para sitios web basados en contenido. Desde la versión 7.0.0 hasta la 7.0.6, la pipeline componible astro/hono instala security.checkOrigin solo a través de la primitiva middleware(), mientras que actions() y pages() pueden despachar a código de usuario de forma independiente. Montar actions() antes de middleware(), como en el ejemplo examples/advanced-routing y la documentación de Cloudflare Hono, permite que las peticiones de acción codificadas en farmulario de origen cruzado se ejecuten antes de la verificación de origen, y usar pages() sin middleware() omite la verificación para endpoints y páginas bajo demya. La vulnerabilidad permite la falsificación de petición en sitios cruzados ciega de solo escritura utilizyo las cookies de la víctima contra ActionHyler.hyle y PagesHyler.hyleWithErrorFallback cuyo manifest.checkOrigin está habilitado; el atacante puede desencadenar una acción o un gestor de endpoint que muta el estado, pero no puede leer la respuesta de origen cruzado. La pipeline astro() no componible predeterminada no se ve afectada. Este problema está solucionado en la versión 7.0.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"withastro","product":"astro","versions":[{"version":">= 7.0.0, < 7.0.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-13T17:49:22.329880Z","id":"CVE-2026-73423","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/pull/17250","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/releases/tag/astro@7.0.6","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc","source":"security-advisories@github.com"}]}