CVE-2024-47885 json
astro's client-side router has DOM Clobbering Gadget that leads to XSS
published 2024-10-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-3078 , GHSA-m85w-3h95-hcf9
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting (XSS) in websites enables Astro's client-side routing and has *stored* attacker-controlled scriptless HTML elements (i.e., `iframe` tags with unsanitized `name` attributes) on the destination pages. This vulnerability can result in cross-site scripting (XSS) attacks on websites that built with Astro that enable the client-side routing with `ViewTransitions` and store the user-inserted scriptless HTML tags without properly sanitizing the `name` attributes on the page. Version 4.16.1 contains a patch for this issue.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | astro | >=3.0.0, <4.16.1 |
4.16.1 |
Affected products
- withastro astro
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/withastro/astro/commit/a4ffbfaa5cb460c12bd486fd75e36147f51d3e5e
web, patch
-
github.com
/withastro/astro/security/advisories/GHSA-m85w-3h95-hcf9
web, vendor-advisory
-
github.com
/withastro/astro/blob/7814a6cad15f06931f963580176d9b38aa7819f2/packages/astro/src/transitions/router.ts#L135-L
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2024-47885
advisory
-
github.com
/withastro/astro
package
Sources
- CVE List CVE-2024-47885
- GitHub Advisory GHSA-m85w-3h95-hcf9
- NVD CVE-2024-47885
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.