CVE-2024-47885 json
astro's client-side router has DOM Clobbering Gadget that leads to XSS
published 2y ago modified 4mo ago also EUVD-2024-3078 , GHSA-m85w-3h95-hcf9
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting (XSS) in websites enables Astro's client-side routing and has *stored* attacker-controlled scriptless HTML elements (i.e., `iframe` tags with unsanitized `name` attributes) on the destination pages. This vulnerability can result in cross-site scripting (XSS) attacks on websites that built with Astro that enable the client-side routing with `ViewTransitions` and store the user-inserted scriptless HTML tags without properly sanitizing the `name` attributes on the page. Version 4.16.1 contains a patch for this issue.
Patch / fix
Is CVE-2024-47885 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | astro | >=3.0.0, <4.16.1 |
4.16.1 |
Affected products
- withastro astro
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/withastro/astro/commit/a4ffbfaa5cb460c12bd486fd75e36147f51d3e5e
web, patch
-
github.com
/withastro/astro/security/advisories/GHSA-m85w-3h95-hcf9
web, vendor-advisory, advisory
-
github.com
/withastro/astro/blob/7814a6cad15f06931f963580176d9b38aa7819f2/packages/astro/src/transitions/router.ts#L135-L
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2024-47885
advisory
-
github.com
/withastro/astro
package
Sources
- CVE List CVE-2024-47885
- GitHub Advisory GHSA-m85w-3h95-hcf9
- NVD CVE-2024-47885
- Maintainer advisory GHSA-m85w-3h95-hcf9
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of withastro/astro published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.