CVE-2025-64757

LOW

3.5

Description

Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system. This issue has been patched in version 5.14.3.

CVE Details

CVSS v3.1 Score3.5

SeverityLOW

CVSS VectorCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack VectorADJACENT_NETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published11/19/2025

Last Modified11/20/2025

Sourcenvd

Honeypot Sightings0

Affected Products

astro:astro

Weaknesses (CWE)

CWE-22CWE-23

References

https://github.com/withastro/astro/commit/b8ca69b97149becefaf89bf21853de9c905cdbb7(security-advisories@github.com)

https://github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.