AIKIDO-2024-10334

astro is vulnerable to Cross-site Scripting (XSS)

Low

astro js

AIKIDO-2024-10334: astro is vulnerable to Cross-site Scripting (XSS) in versions 3.2.0 - 4.16.0.

Cross-site Scripting (XSS)

Vuln in 3.2.0 - 4.16.0

Fixed in 4.16.1

No CVE available

TL;DR

Affected versions of the package are vulnerable to Cross-site Scripting (XSS). If the application has a 'name="scripts"' this will shadow the built-in 'document.scripts'.

Who does this affect?

You're affected if you are using a version which is within vulnerability ranges.

How can it be fixed?

Upgrade astro library to patch version.

Background info

Link to vendor website

Are you

to these issues?

Connect your GitHub, GitLab, Bitbucket or Azure DevOps account to start scanning your repos for free.

Start For Free

Your data won't be shared · Read-only access

🇪🇺 Grauwpoort 1, 9000 Ghent, Belgium

🇺🇸 95 Third St, 2nd Fl, San Francisco, CA 94103, US