CVE-2025-64745

Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this vulnerability only affects the development server and not production builds, it could be exploited to compromise developer environments through social engineering or malicious links. Version 5.15.6 fixes the issue.

• CWE-79

• https://github.com/withastro/astro/blob/5bc37fd5cade62f753aef66efdf40f982379029a/packages/astro/src/template/4xx.ts#L133-L149Product
• https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91Patch
• https://github.com/withastro/astro/pull/12994Patch
• https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7Exploit, Third Party Advisory

Published

Nov 13, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64738External control of file name or path in Zoom Workplace for …5.5
• CVE-2025-64739External control of file name or path in certain Zoom Client…7.5
• CVE-2025-6474A vulnerability has been found in code-projects Inventory Ma…9.8
• CVE-2025-64740Improper verification of cryptographic signature in the inst…7.8
• CVE-2025-64741Improper authorization handling in Zoom Workplace for Androi…9.8
• CVE-2025-64744OpenObserve is a cloud-native observability platform. In ver…3.5
• CVE-2025-64746Directus is a real-time API and App dashboard for managing S…5.4
• CVE-2025-64747Directus is a real-time API and App dashboard for managing S…5.5
• CVE-2025-64748Directus is a real-time API and App dashboard for managing S…6.5
• CVE-2025-64749Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2025-6475A vulnerability was found in SourceCodester Student Result M…4.8
• CVE-2025-64750SingularityCE and SingularityPRO are open source container p…4.5