@astrojs/internal-helpers vulnerabilities (TuxCare)
24 vulnerabilities.
-
@astrojs/internal-helpersTuxCare Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base 6.3 Medium -
@astrojs/internal-helpersTuxCare Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) 5.1 Medium -
@astrojs/internal-helpersTuxCare @astrojs/rss: XML Injection via Unescaped RSS Feed Fields 4.3 Medium -
@astrojs/internal-helpersTuxCare Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands 2.1 Low -
@astrojs/internal-helpersTuxCare Astro: Reflected XSS via unescaped View Transition animation properties 5.3 Medium -
@astrojs/internal-helpersTuxCare Astro: XSS via Unescaped Attribute Names in Spread Props 4.2 Medium -
@astrojs/internal-helpersTuxCare Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) 7.5 High -
@astrojs/internal-helpersTuxCare Astro: Reflected XSS via unescaped slot name 7.1 High -
@astrojs/internal-helpersTuxCare Astro: Server island encrypted parameters vulnerable to cross-component replay 2.9 Low -
@astrojs/internal-helpersTuxCare Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass 6.1 Medium -
@astrojs/internal-helpersTuxCare Astro: Remote allowlist bypass via unanchored matchPathname wildcard 2.9 Low -
@astrojs/internal-helpersTuxCare Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 6.5 Medium -
@astrojs/internal-helpersTuxCare Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values 6.9 Medium -
@astrojs/internal-helpersTuxCare Astro is vulnerable to Reflected XSS via the server islands feature 7.1 High -
@astrojs/internal-helpersTuxCare Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint 5.4 Medium -
@astrojs/internal-helpersTuxCare Astro Development Server is Vulnerable to Arbitrary Local File Read 3.5 Low -
@astrojs/internal-helpersTuxCare Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass 6.5 Medium -
@astrojs/internal-helpersTuxCare vite allows server.fs.deny bypass via backslash on Windows 6.0 Medium -
@astrojs/internal-helpersTuxCare Astro's `X-Forwarded-Host` is reflected with no validation 6.5 Medium -
@astrojs/internal-helpersTuxCare Vite middleware may serve files starting with the same name with the public directory 2.3 Low -
@astrojs/internal-helpersTuxCare Unauthorized third-party images in Astro’s _image endpoint 6.9 Medium -
@astrojs/internal-helpersTuxCare Server source code is exposed to the public if sourcemaps are enabled 7.8 High -
@astrojs/internal-helpersTuxCare Bypass of CSRF Middleware in Astro 5.9 Medium -
@astrojs/internal-helpersTuxCare astro's client-side router has DOM Clobbering Gadget that leads to XSS 5.9 Medium