{"id":"EUVD-2025-198182","revision":"3f2e218668ee4bf999ca73f8a9b2750c","records":[{"revision":"3f2e218668ee4bf999ca73f8a9b2750c","observedAt":"2026-10-27T23:52:15.794+00:00","statement":{"source":"euvd","id":"EUVD-2025-198182","aliases":["CVE-2025-65019","GHSA-fvmw-cj7j-j39q"],"title":"Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() funct…","description":"Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections. This issue has been patched in version 5.15.9.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4,"severity":null}],"references":["https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q","https://github.com/withastro/astro/commit/9e9c528191b6f5e06db9daf6ad26b8f68016e533"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198182","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 19, 2025, 4:40:47 PM","dateUpdated":"Nov 19, 2025, 9:05:19 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-198182","identifiers":["EUVD-2025-198182","CVE-2025-65019","GHSA-fvmw-cj7j-j39q"]},"retained":false,"historicalAffected":[]}],"coverage":[]}