-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in the isRemoteAllowed function located in packages/internal-helpers/src/remote.ts. The analysis of the security patch in commit 9e9c528191b6f5e06db9daf6ad26b8f68016e533 reveals the root cause. The original code contained a specific block that explicitly and unconditionally allowed any URL using the data: protocol by returning true without further validation. This flaw could be exploited by crafting a data: URL that points to a malicious SVG file containing embedded JavaScript. When Astro's image optimization endpoint (/_image) was used, it would process this URL, leading to the execution of the malicious script in the user's browser. The patch rectifies this by removing the unconditional allowance for data: URLs and instead treats them like other protocols, subjecting them to the same security pattern checks. Therefore, the isRemoteAllowed function is the direct source of the vulnerability.
isRemoteAllowedpackages/internal-helpers/src/remote.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| astro | npm | < 5.15.9 | 5.15.9 |
Ongoing coverage of React2Shell