CVE-2025-55207 Information

Aug 16, 2025 cve

Description

Astro is a web framework for content-driven websites. Following CVE-2025-54793 there’s still an Open Redirect vulnerability in a subset of Astro deployment scenarios prior to version 9.4.1. Astro 5.12.8 addressed CVE-2025-54793 where https://example.com//astro.build/press would redirect to the external origin //astro.build/press. However with the Node deployment adapter in standalone mode and trailingSlash set to lways\ in the Astro configuration https://example.com//astro.build/press still redirects to //astro.build/press. This affects any user who clicks on a specially crafted link pointing to the affected domain. Since the domain appears legitimate victims may be tricked into trusting the redirected page leading to possible credential theft malware distribution or other phishing-related attacks. This issue has been patched in version 9.4.1.

Reference

https://github.com/withastro/astro/commit/5fc3c599cacb0172cc7d8e1202a5f2e8685d7ef2 https://github.com/withastro/astro/security/advisories/GHSA-9x9c-ghc5-jhw9

CNNVD-202508-1868 (Published: 2025-08-15)

Share on: