Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the Astro development server's image optimization endpoint. The provided patch b8ca69b97149becefaf89bf21853de9c905cdbb7 clearly shows the vulnerable code being removed from packages/astro/src/assets/endpoint/node.ts. Specifically, the loadLocalImage function had a code branch for development mode (import.meta.env.DEV) that directly converted the user-supplied src parameter into a file path without any path traversal checks. This allowed reading arbitrary files from the filesystem. The GET handler in the same file is the entry point that receives the malicious request and calls loadLocalImage. The fix involves moving the development server logic to a new file (packages/astro/src/assets/endpoint/dev.ts) and adding a check using isParentDirectory to ensure the requested file is within the project's root directory. The original loadLocalImage function and the GET handler in node.ts were the vulnerable components.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| astro | npm | < 5.14.3 | 5.14.3 |
