DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-HP3V-MFQW-H74C: GHSA-hp3v-mfqw-h74c: Missing Character Escaping in @astrojs/netlify Remote Image Pattern Configuration

#security #cve #cybersecurity #ghsa

GHSA-hp3v-mfqw-h74c: Missing Character Escaping in @astrojs/netlify Remote Image Pattern Configuration

Vulnerability ID: GHSA-HP3V-MFQW-H74C
CVSS Score: 3.7
Published: 2026-07-20

A security vulnerability in @astrojs/netlify allows attackers to bypass remote image path restrictions by leveraging unescaped regular expression metacharacters. The integration adapter fails to sanitize developer-defined pathnames before interpolating them into a configuration JSON file consumed by Netlify's Edge Image CDN. This results in overly permissive matching behavior at the edge routing layer, enabling path-traversal and filter bypasses.

TL;DR

The @astrojs/netlify adapter fails to escape dots and other regular expression metacharacters in developer-defined image pathnames, generating insecure edge configurations that permit attackers to bypass path-level restrictions on Netlify's Image CDN.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-185: Incorrect Regular Expression / CWE-116: Improper Output Escaping
  • Attack Vector: Network
  • CVSS v3.1 Score: 3.7 (Low)
  • EPSS Score: Not Available
  • Impact: Filter Bypass / Resource Hijacking
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • Astro applications deployed on Netlify using @astrojs/netlify < 8.1.2
  • @astrojs/netlify: < 8.1.2 (Fixed in: 8.1.2)

Exploit Details

  • GitHub Security Advisory: Advisory text containing configuration details and technical explanation of the bypass mechanics.

Mitigation Strategies

  • Upgrade @astrojs/netlify integration to version 8.1.2 or higher
  • Avoid utilizing dot characters or special regular expression symbols inside pathnames in astro.config.mjs remotePatterns
  • Restrict the configured remotePatterns hostname to highly specific subdomains or folders to limit bypass surface

Remediation Steps:

  1. Run 'npm install @astrojs/netlify@latest' (or equivalent package manager command) to update the package to version 8.1.2 or later
  2. Verify the output by building the project locally using 'npm run build'
  3. Examine the generated '.netlify/v1/config.json' and verify that dots in pathnames are preceded by double backslashes (e.g., '\.')

References

Read the full report for GHSA-HP3V-MFQW-H74C on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)