CVE-2024-47885 astro's client-side router has DOM Clobbering Gadget that leads to XSS
Attackers can execute arbitrary JavaScript via DOM clobbering in Astro's client-side router if ViewTransitions are enabled and user HTML is unsanitized.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-47885?
CVE-2024-47885 is a medium-severity cross-site scripting vulnerability in withastro astro, published on 14 Oct 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting (XSS) in websites enables Astro's client-side routing and has *stored* attacker-controlled scriptless HTML elements (i.e., `iframe` tags with unsanitized `name` attributes) on the destination pages. This vulnerability can result in cross-site scripting (XSS) attacks on websites that built with Astro that enable the client-side routing with `ViewTransitions` and store the user-inserted scriptless HTML tags without properly sanitizing the `name` attributes on the page. Version 4.16.1 contains a patch for this issue.
Weakness: CWE-79
Which versions are affected by CVE-2024-47885?
2 open source packages ship an affected version, including astro. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
astro npm | From 3.0.0 | 4.16.1 |
astro npm | From 3.0.0 | 4.16.1 |
Products include Astro Astro.
How do I fix CVE-2024-47885?
Upgrade astro to 4.16.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47885 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47885 exists.
Other vulnerabilities in withastro astro
- CVE-2024-56159 Server source code is exposed to the public if sourcemaps are enabled
- CVE-2026-54299 Astro: Host header SSRF in prerendered error page fetch
- CVE-2025-59837 astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
- CVE-2026-50146 Astro: Reflected XSS via unescaped slot name
- CVE-2025-64764 Astro is vulnerable to Reflected XSS via the server islands feature
Sources
Also known as GHSA-m85w-3h95-hcf9.