CVE-2025-64764 describes a reflected Cross-Site Scripting (XSS) vulnerability in the Astro web framework, affecting versions prior to 5.15.8, specifically when the server islands feature is utilized. This medium-severity vulnerability (CVSS 5.4) can be exploited with low attack complexity via a network vector, requiring user interaction, and could lead to limited confidentiality and integrity impacts. While there is no evidence of active exploitation or Metasploit modules, a Nuclei template exists for detection, and the CVE has minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.15.8CPE matchmatch criteria | cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.