Vulnerability GHSA-26w7-cxv4-gfx2
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
2 months ago
September 08, 2026 at 09:26 PM UTC
Astro: Remote code execution through AVIF image optimization
<7.2.8
<7.2.8
Summary
Astro: Remote code execution through AVIF image optimization
Details
A vulnerability in libheif, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.
Projects are affected when an attacker can cause Astro to process an untrusted AVIF image.
The fix was released in Astro 7.2.8, which requires Sharp 0.35.4.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
2 hours ago
Astro: XSS via attribute injection in dynamic tag names
<7.4.5 GHSA-mh32-jxcr-mh9f
<7.4.5 GHSA-mh32-jxcr-mh9f
Medium Risk
2 hours ago
Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
>=5.14.3 <7.4.7 GHSA-r3h5-4585-7x3w
>=5.14.3 <7.4.7 GHSA-r3h5-4585-7x3w
Medium Risk
22 days ago
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
<7.3.2 GHSA-98hj-9722-w3j8
<7.3.2 GHSA-98hj-9722-w3j8
Low Risk
22 days ago
Astro: Arbitrary CSS injection in Astro View Transitions
>=7.1.0 <7.3.3 GHSA-mpr7-6m5w-76rw
>=7.1.0 <7.3.3 GHSA-mpr7-6m5w-76rw
Medium Risk
2 months ago
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
<7.2.4 GHSA-376h-93r7-7g6f
<7.2.4 GHSA-376h-93r7-7g6f
Impacted packages
Timeline
Published
2 months ago
September 08, 2026 at 09:26 PM UTC
Fixed (7.2.8)
2 months ago
August 26, 2026 at 09:02 PM UTC
Last Modified
2 months ago
September 08, 2026 at 09:30 PM UTC