Remote Path Traversal Vulnerability in Astro Web Framework
CVE-2026-33769

2.9LOW

Key Information:

Vendor

Withastro

Status
Astro
Vendor
CVE Published:
24 March 2026

What is CVE-2026-33769?

The Astro web framework has a vulnerability in its remotePatterns path enforcement for remote URLs utilized by server-side fetchers, affecting versions from 2.10.10 up to but not including 5.18.1. The unanchored path matching logic for wildcard patterns allows attackers to exploit this flaw by fetching paths outside the intended allowlisted prefix on permissible hosts. This exposure can enable unauthorized access to sensitive data. A patch has been released in version 5.18.1 to address this issue.

Affected Version(s)

astro >= 2.10.10, < 5.18.1

References

https://github.com/withastro/astro/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
2.9
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.