{"uuid": "bd4830d2-e43a-46dc-8c8b-703c684be9f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-26W7-CXV4-GFX2", "type": "seen", "source": "https://gist.github.com/alon710/11e7eed7c8dbba64dfd17240ce29c0f4", "content": "# GHSA-26W7-CXV4-GFX2: GHSA-26W7-CXV4-GFX2: Remote Code Execution in Astro via Outdated Sharp Native Dependency\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/GHSA-26W7-CXV4-GFX2\n\n## Summary\nA critical remote code execution vulnerability in Astro's image optimization pipeline allows unauthenticated attackers to trigger memory corruption via malformed AVIF images, due to outdated native dependencies in the sharp package.\n\n## TL;DR\nUnauthenticated remote code execution via malformed AVIF image processing in Astro web framework version < 7.2.8.\n\n## Technical Details\n\n- **CWE ID**: CWE-119\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 9.8 (Critical)\n- **Exploit Status**: None (Theoretical Vector)\n- **KEV Status**: Not Listed\n- **Patch Status**: Fixed in Astro 7.2.8\n\n## Affected Systems\n\n- Astro Web Framework\n- Sharp Image Processing Library\n- Node.js Native Addons\n- **Astro**: < 7.2.8 (Fixed in: `7.2.8`)\n\n## Mitigation\n\n- Disable AVIF support in Astro image configuration\n- Upgrade Astro framework to version 7.2.8 or higher\n- Force-update transitive sharp dependency to 0.35.4 or higher\n\n**Remediation Steps:**\n1. Verify the resolved sharp version in your lockfile using 'npm ls sharp' or 'pnpm why sharp'.\n2. Update Astro in your package.json to '^7.2.8'.\n3. Run your package manager's update command (e.g. 'pnpm update astro' or 'npm install astro@7.2.8') to refresh dependencies and regenerate the lockfile.\n\n## References\n\n- [GitHub Advisory: GHSA-26W7-CXV4-GFX2](https://github.com/advisories/GHSA-26W7-CXV4-GFX2)\n- [Astro Fix Commit](https://github.com/withastro/astro/commit/ecb4082131490b4fe9a56aa44fda84b54ef8967b)\n- [Astro Release 7.2.8](https://github.com/withastro/astro/releases/tag/astro@7.2.8)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-26W7-CXV4-GFX2) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T12:32:30.239799Z"}