# CVE-2025-64764: Astro reflected XSS via server islands feature

Source: https://junglewise.ai/threats/cve-2025-64764-astro-reflected-xss-via-server-islands-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-64764 · Severity: high · CVSS 7.1 · Published 2025-11-19

Astro is a web framework used to build fast, content-focused websites. The server islands feature allows dynamic server-rendered components, but contains an XSS vulnerability that allows attackers to inject malicious scripts through URL parameters. An attacker can craft a special URL that, when clicked by a user, executes arbitrary JavaScript in the victim's browser, potentially stealing session cookies, credentials, or performing actions on behalf of the user.

Technologies: [Astro](https://junglewise.ai/threats/technologies/astro-astro), [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [Astro](https://junglewise.ai/threats/vendors/astro), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-64764 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64764 being exploited in the wild.

**How severe is CVE-2025-64764?** High severity, with a CVSS score of 7.1, published 19 November 2025.

**Which products and versions are affected?** astro (npm) SEMVER:introduced=0,fixed=5.15.8.

**Is there a fix for CVE-2025-64764?** Yes. astro (npm): upgrade to 5.15.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-64764 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-64764?** Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 5.15.8 or later

  ```sh
  npm install astro@5.15.8
  ```


## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in Astro's server islands feature. The `/_server-islands/[name]` endpoint accepts three parameters: `e` (component export), `p` (properties), and `s` (slots). When the `e` parameter is set to "file", the endpoint generates an HTML template using the island's absolute file path as an HTML tag name and injects the `s` parameter value directly as child content using `markHTMLString` without proper sanitization. This allows an unauthenticated attacker to inject arbitrary HTML/JavaScript via the `s` parameter in a URL. The attack requires user interaction (clicking a malicious link) but works regardless of the actual component template design. The vulnerability affects all versions up to 5.15.6 and is patched in version 5.15.8.

## Affected products

- Astro Astro <= 5.15.6

## Identifiers

- CVE-2025-64764
- GHSA-wrwg-2hg8-v723

## Timeline

- 2025-11-19: disclosed
- 2025-11-19: patched: Fixed in version 5.15.8

## References

- [https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723](https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723)

## Related threats

- [Astro case-sensitive path bypass in image endpoint](https://junglewise.ai/threats/cve-2026-126364-astro-is-a-web-framework-for-content-driven-websites-from-5-14-3)
- [Astro HTML injection in dynamic element rendering](https://junglewise.ai/threats/cve-2026-126361-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)