GHSA-26w7-cxv4-gfx2 json
Astro: Remote code execution through AVIF image optimization
published 2mo ago modified 2mo ago
- cvss
- 9.8
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
A vulnerability in `libheif`, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.
Projects are affected when an attacker can cause Astro to process an untrusted AVIF image.
The fix was released in Astro 7.2.8, which requires Sharp 0.35.4.
Patch / fix
- npm astro 7.2.8
Is GHSA-26w7-cxv4-gfx2 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | astro | <7.2.8 |
7.2.8 |
Classification
References
-
github.com
/withastro/astro/commit/ecb4082131490b4fe9a56aa44fda84b54ef8967b
web
-
github.com
/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
web
-
github.com
/withastro/astro/security/advisories/GHSA-26w7-cxv4-gfx2
web, advisory
-
github.com
/withastro/astro
package
-
github.com
/withastro/astro/releases/tag/astro@7.2.8
web
Sources
- GitHub Advisory GHSA-26w7-cxv4-gfx2
- Maintainer advisory GHSA-26w7-cxv4-gfx2
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of withastro/astro published their own advisory on GitHub. Reviewed sources take precedence over it.