{"id":"EUVD-2026-38334","enisaUuid":"070c40c0-7953-3f0b-beaa-6dcb6c195ec2","description":"@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader semantics than Astro\u0027s canonical matcher. A single wildcard hostname such as *.example.com is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as /ok/* is converted without end anchoring, so deeper paths match by prefix. This vulnerability is fixed in 7.0.13.","datePublished":"Jun 22, 2026, 5:30:49 PM","dateUpdated":"Jun 23, 2026, 2:08:54 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-529g-xq4f-cw38\n","aliases":"CVE-2026-54300\nGHSA-529g-xq4f-cw38\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"e218ef47-21f6-3aba-bd7c-e933a1160aa6","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 7.0.13"}],"enisaIdVendor":[{"id":"2413f61c-a675-32a0-88d8-0220fc86456e","vendor":{"name":"withastro"}}],"enisaIdVulnerability":[{"id":"3e1e0fff-77f3-3e49-bed9-aaac71dab6bc","vulnerability":{"id":"CVE-2026-54300","description":"@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader semantics than Astro\u0027s canonical matcher. A single wildcard hostname such as *.example.com is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as /ok/* is converted without end anchoring, so deeper paths match by prefix. This vulnerability is fixed in 7.0.13.","datePublished":"Jun 22, 2026, 5:30:49 PM","dateUpdated":"Jun 23, 2026, 2:08:54 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-529g-xq4f-cw38\n","enisa_id":"EUVD-2026-38334\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 28, 2026, 7:16:10 AM","vulnerabilityProduct":[{"id":"b8a10811-42a6-3407-a3da-5b0dda1fe333","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 7.0.13"}],"vulnerabilityVendor":[{"id":"b35b9002-f4cf-3805-a791-e304a41e0c4e","vendor":{"name":"withastro"}}]}},{"id":"9efcc401-37ff-3dba-9eb6-ff3f5dce1b35","vulnerability":{"id":"GHSA-529g-xq4f-cw38","description":"@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config","datePublished":"Jun 16, 2026, 2:37:33 PM","dateUpdated":"Jul 18, 2026, 5:24:59 PM","baseScore":0.0,"references":"https://github.com/withastro/astro/security/advisories/GHSA-529g-xq4f-cw38\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54300\nhttps://github.com/withastro/astro\n","enisa_id":"EUVD-2026-38334\n","aliases":"GHSA-529g-xq4f-cw38\nCVE-2026-54300\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}