Executive brief
Astro is a web framework used to build fast websites and web applications. The development server's error page contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious code through specially crafted URLs. This could enable account takeover or session hijacking of developers who click on malicious links, particularly in social engineering attacks or when dev servers are exposed to the internet.
Technical details
A reflected XSS vulnerability exists in Astro's development server error page template (packages/astro/src/template/4xx.ts) when the trailingSlash configuration is set to 'always' or 'never'. The root cause is insufficient output encoding: the `corrected` variable (derived from the user-controlled pathname parameter) is interpolated directly into HTML without escaping, even though the pathname variable is escaped elsewhere in the same file. An attacker crafts a URL with JavaScript payload that executes in the victim's browser when the dev server returns a 404 page. This only affects the development server (not production builds) and requires user interaction (clicking a link). Patches are available in Astro >= 5.15.6.
Affected products
- Astro Astro >= 5.2.0, < 5.15.6
Timeline
- 2025-11-13: disclosed
- 2025-11-13: patched: Fixed in version 5.15.6