CVE

CVE-2025-64764

7.1

CVSShigh

Exploitable remotely over the internet · no authentication required · user interaction needed.

Description

Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.

Attack Vector

Network

Privileges Req.

None

User Interaction

Required

astro

Updated Sep 18, 2026View on NVD →

S4E scanner

highWeb Vulnerabilities~10 seconds

Astro - Reflected XSS via server islands feature

Astro 5.15.8 contains a reflected XSS caused by improper handling of server islands feature, letting remote attackers execute scripts, exploit requires use of server islands in the application. References: https://zhero-web-sec.github.io/research-and-things/unlocking-reflected-xss-in-the-astro-framework Remediation: Update to version 5.15.8 or later.

Used 3.4k times · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: astro

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →