GHSA-26W7-CXV4-GFX2: Remote Code Execution in Astro via Outdated Sharp Native Dependency
Vulnerability ID: GHSA-26W7-CXV4-GFX2
CVSS Score: 9.8
Published: 2026-09-08
A critical remote code execution vulnerability in Astro's image optimization pipeline allows unauthenticated attackers to trigger memory corruption via malformed AVIF images, due to outdated native dependencies in the sharp package.
TL;DR
Unauthenticated remote code execution via malformed AVIF image processing in Astro web framework version < 7.2.8.
Technical Details
- CWE ID: CWE-119
- Attack Vector: Network (Unauthenticated)
- CVSS Score: 9.8 (Critical)
- Exploit Status: None (Theoretical Vector)
- KEV Status: Not Listed
- Patch Status: Fixed in Astro 7.2.8
Affected Systems
- Astro Web Framework
- Sharp Image Processing Library
- Node.js Native Addons
-
Astro: < 7.2.8 (Fixed in:
7.2.8)
Code Analysis
Commit: ecb4082
Update Sharp to 0.35.4 (#17837)
Mitigation Strategies
- Disable AVIF support in Astro image configuration
- Upgrade Astro framework to version 7.2.8 or higher
- Force-update transitive sharp dependency to 0.35.4 or higher
Remediation Steps:
- Verify the resolved sharp version in your lockfile using 'npm ls sharp' or 'pnpm why sharp'.
- Update Astro in your package.json to '^7.2.8'.
- Run your package manager's update command (e.g. 'pnpm update astro' or 'npm install astro@7.2.8') to refresh dependencies and regenerate the lockfile.
References
Read the full report for GHSA-26W7-CXV4-GFX2 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)