{"id":"EUVD-2025-198182","enisaUuid":"eb1221a4-44de-34e6-8849-49237ed48593","description":"Astro is a web framework. Prior to version 5.15.9, when using Astro\u0027s Cloudflare adapter (@astrojs/cloudflare) with output: \u0027server\u0027, the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections. This issue has been patched in version 5.15.9.","datePublished":"Nov 19, 2025, 4:40:47 PM","dateUpdated":"Nov 19, 2025, 9:05:19 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q\nhttps://github.com/withastro/astro/commit/9e9c528191b6f5e06db9daf6ad26b8f68016e533\n","aliases":"CVE-2025-65019\nGHSA-fvmw-cj7j-j39q\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"f50a3e25-dfe5-3e1e-acf7-f794fecc4e46","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 5.15.9"}],"enisaIdVendor":[{"id":"d013352b-8fb7-341d-a0f7-cfeb25790893","vendor":{"name":"withastro"}}],"enisaIdVulnerability":[{"id":"eb7ce6c9-b545-3a0b-93ee-905a0d8df1ab","vulnerability":{"id":"GHSA-fvmw-cj7j-j39q","description":"Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint","datePublished":"Nov 19, 2025, 8:09:12 PM","dateUpdated":"Nov 27, 2025, 8:15:37 AM","baseScore":0.0,"references":"https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-65019\nhttps://github.com/withastro/astro/commit/9e9c528191b6f5e06db9daf6ad26b8f68016e533\nhttps://github.com/withastro/astro\n","enisa_id":"EUVD-2025-198182\n","aliases":"GHSA-fvmw-cj7j-j39q\nCVE-2025-65019\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f852dac2-f398-343a-a06f-320a0300dae1","vulnerability":{"id":"CVE-2025-65019","description":"Astro is a web framework. Prior to version 5.15.9, when using Astro\u0027s Cloudflare adapter (@astrojs/cloudflare) with output: \u0027server\u0027, the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections. This issue has been patched in version 5.15.9.","datePublished":"Nov 19, 2025, 4:40:47 PM","dateUpdated":"Nov 19, 2025, 9:05:19 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q\nhttps://github.com/withastro/astro/commit/9e9c528191b6f5e06db9daf6ad26b8f68016e533\n","enisa_id":"EUVD-2025-198182\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Oct 29, 2026, 7:19:39 AM","vulnerabilityProduct":[{"id":"06738c2f-282e-3164-bbc0-b0ce9602af16","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 5.15.9"}],"vulnerabilityVendor":[{"id":"c8162042-d310-3aea-b305-5be14a5b1f97","vendor":{"name":"withastro"}}]}}],"enisaIdAdvisory":[]}