Executive brief
Astro is a popular web framework with a built-in development server for testing sites locally. The development server's image optimization feature contains a path traversal vulnerability that allows an attacker running on the same network to read any image file accessible to the Node.js process, potentially exposing sensitive system files or application data.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the Node.js image endpoint handler (packages/astro/src/assets/endpoint/node.ts) used during development mode. The endpoint accepts an href parameter without proper validation in development mode, allowing absolute file paths to be specified. An attacker with network access to the development server (typically running on localhost:4321) can craft HTTP GET requests to the /_image endpoint with absolute paths, bypassing the path restrictions that exist in the production code path. The attack requires the development server to be running and the target image files to be readable by the Node.js process. Exploitation results in arbitrary local file read, with the attacker receiving the image contents in the HTTP response. The vulnerability is fixed in Astro version 5.14.3 and later.
Affected products
- Astro Astro < 5.14.3
Timeline
- 2025-11-19: disclosed
- 2025-11-19: patched: Fixed in version 5.14.3