Critical Remote Code Execution Vulnerability in Astro Package Due to AVIF Image Optimization
Summary
GHSA-26w7-cxv4-gfx2: Astro: Remote code execution through AVIF image optimization. Affects astro versions < 7.2.8. Fixed in 7.2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that allows developers to build fast websites using various frameworks. It leverages the Sharp image processing library for image optimization, which enhances performance by reducing image sizes. However, a vulnerability in the underlying library, libheif, exposes Astro to potential remote code execution when processing untrusted AVIF images.
Vulnerability Detail
A critical vulnerability exists in the libheif library used by Astro's default image service, Sharp. This flaw allows an attacker to exploit the image optimization process by submitting a malicious AVIF image. If Astro processes this image, it can lead to remote code execution on the server, compromising the integrity and security of the application. The vulnerability is classified with a CVSS score of 9.8, indicating its severity and potential impact on affected systems.
How To Fix
Latest published version: 7.4.2 as of 23 Oct 2026
npm install astro@7.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.2.8
This is the first release that contains the fix.
npm install astro@7.2.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling image optimization features in Astro until the package can be updated. This can be done by modifying the configuration settings in your Astro project to avoid processing untrusted AVIF images.
Conclusion
The vulnerability in Astro related to AVIF image optimization poses a significant risk of remote code execution. It is crucial for developers using Astro to update to version 7.2.8 or later to protect their applications. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for astro →
FAQ
The vulnerability allows for remote code execution through the processing of malicious AVIF images in Astro.
If your project uses Astro and processes AVIF images, it is potentially affected. You can check your application's vulnerability status using Vulert.
The CVSS score for this vulnerability is 9.8, indicating a critical level of risk.
Yes, you can use Vulert to monitor your project's dependencies for vulnerabilities in real-time without needing to access the code.
Consider disabling image optimization features in Astro as a temporary workaround until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for astro.
