Cross-Site Scripting Vulnerability in Astro Web Framework with Cloudflare Adapter
CVE-2025-65019

5.4MEDIUM

Key Information:

Vendor

Withastro

Status
Astro
Vendor
CVE Published:
19 November 2025

What is CVE-2025-65019?

The Astro web framework, specifically when utilizing the Cloudflare adapter (@astrojs/cloudflare) with an output setting of 'server', was found to have a serious vulnerability prior to version 5.15.9. This occurred in the image optimization endpoint (/_image), where the isRemoteAllowed() function improperly permitted data: protocol URLs. As a result, this flaw opened the door for Cross-Site Scripting (XSS) attacks by allowing the execution of malicious SVG payloads without adhering to the specified domain restrictions and undermining Content Security Policy protections. The vulnerability has been addressed and patched in version 5.15.9.

Affected Version(s)

astro < 5.15.9

References

https://github.com/withastro/astro/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/withastro/astro/commit/9e9c528191b6f5e...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-65019 : Cross-Site Scripting Vulnerability in Astro Web Framework with Cloudflare Adapter