Open Redirect Vulnerability in Astro Framework by Astro
CVE-2025-54793

5.5MEDIUM

Key Information:

Vendor

Withastro

Status
Astro
Vendor
CVE Published:
8 August 2025

What is CVE-2025-54793?

Astro, a web framework used for content-driven websites, has an open redirect vulnerability present in versions 5.2.0 to 5.12.7. This issue stems from the framework's handling of paths with double slashes in its trailing slash redirection logic. Attackers may exploit this vulnerability to redirect users to malicious external domains through specially crafted URLs, raising the risk of phishing and social engineering attempts. Sites utilizing on-demand server-side rendering (SSR) with Node or Cloudflare adapters are particularly affected. However, static sites and those deployed on Netlify or Vercel are not impacted. The vulnerability has been addressed in version 5.12.8, and it is recommended to block outgoing redirect responses with a Location header starting with // as a temporary measure.

Affected Version(s)

astro >= 5.2.0, < 5.12.8

References

https://github.com/withastro/astro/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/withastro/astro/commit/0567fb7b50c0c45...
x_refsource_MISC

CVSS V4

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54793 : Open Redirect Vulnerability in Astro Framework by Astro