GHSA-26w7-cxv4-gfx2 json
Astro: Remote code execution through AVIF image optimization
published 2026-09-08 2 mo ago modified 2026-09-08 2 mo ago
- cvss
- 9.8
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
A vulnerability in `libheif`, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.
Projects are affected when an attacker can cause Astro to process an untrusted AVIF image.
The fix was released in Astro 7.2.8, which requires Sharp 0.35.4.
Patch / fix
- npm astro 7.2.8
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | astro | <7.2.8 |
7.2.8 |
Classification
References
-
github.com
/withastro/astro/commit/ecb4082131490b4fe9a56aa44fda84b54ef8967b
web
-
github.com
/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
web
-
github.com
/withastro/astro/security/advisories/GHSA-26w7-cxv4-gfx2
web
-
github.com
/withastro/astro
package
-
github.com
/withastro/astro/releases/tag/astro@7.2.8
web
Sources
- GitHub Advisory GHSA-26w7-cxv4-gfx2
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.