CVE-2024-47885

The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting (XSS) in websites enables Astro's client-side routing and has *stored* attacker-controlled scriptless HTML elements (i.e., `iframe` tags with unsanitized `name` attributes) on the destination pages. This vulnerability can result in cross-site scripting (XSS) attacks on websites that built with Astro that enable the client-side routing with `ViewTransitions` and store the user-inserted scriptless HTML tags without properly sanitizing the `name` attributes on the page. Version 4.16.1 contains a patch for this issue.

• CWE-79

• https://github.com/withastro/astro/blob/7814a6cad15f06931f963580176d9b38aa7819f2/packages/astro/src/transitions/router.ts#L135-L156Product
• https://github.com/withastro/astro/commit/a4ffbfaa5cb460c12bd486fd75e36147f51d3e5ePatch
• https://github.com/withastro/astro/security/advisories/GHSA-m85w-3h95-hcf9Vendor Advisory

Published

Oct 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4788The Boostify Header Footer Builder for Elementor plugin for …4.3
• CVE-2024-47880OpenRefine is a free, open source tool for working with mess…6.9
• CVE-2024-47881OpenRefine is a free, open source tool for working with mess…8.8
• CVE-2024-47882OpenRefine is a free, open source tool for working with mess…6.1
• CVE-2024-47883The OpenRefine fork of the MIT Simile Butterfly server is a …9.1
• CVE-2024-47884foxmarks is a CLI read-only interface for Firefox's bookmark…2.4
• CVE-2024-47886Chamilo is a learning management system. Chamillo is affecte…7.2
• CVE-2024-47887Action Pack is a framework for handling and responding to we…6.6
• CVE-2024-47888Action Text brings rich text content and editing to Rails. S…6.6
• CVE-2024-47889Action Mailer is a framework for designing email service lay…6.6
• CVE-2024-4789Cost Calculator Builder Pro plugin for WordPress is vulnerab…6.4
• CVE-2024-47891Software installed and run as a non-privileged user may cond…7.8