GHSA-26w7-cxv4-gfx2 Astro: Remote code execution through AVIF image optimization
Remote code execution via malicious AVIF images processed by Astro's default image optimization service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-26w7-cxv4-gfx2?
GHSA-26w7-cxv4-gfx2 is a code injection vulnerability in astro, published on 8 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in libheif, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.
Projects are affected when an attacker can cause Astro to process an untrusted AVIF image.
The fix was released in Astro 7.2.8, which requires Sharp 0.35.4.
Which versions are affected by GHSA-26w7-cxv4-gfx2?
2 open source packages ship an affected version, including astro.
| Package | Affected | Fixed in |
|---|---|---|
astro npm | All versions | 7.2.8 |
astro npm | All versions | 7.2.8 |
How do I fix GHSA-26w7-cxv4-gfx2?
Upgrade astro to 7.2.8 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-26w7-cxv4-gfx2 being exploited?
There is no known exploitation of GHSA-26w7-cxv4-gfx2 in the wild and no public exploit code.