Astro

Astro: Remote code execution through AVIF image optimization

Astro: Host header SSRF in prerendered error page fetch

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Astro's server source code is exposed to the public if sourcemaps are enabled

Astro: Reflected XSS via unescaped View Transition animation properties

Astro's `X-Forwarded-Host` is reflected without validation

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Astro: Reflected XSS via unescaped slot name

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Atro CSRF Middleware Bypass (security.checkOrigin)