Astro: Remote code execution through AVIF image optimization

Published September 8, 2026 GHSA-26w7-cxv4-gfx2

Astro can run attacker code while optimizing a malicious AVIF image. The project must accept and process an image the attacker controls.

Severity
CriticalCVSS 9.8
Fix
Fixed in 7.2.8Fix recorded 3 days ago
Affected versions
before 7.2.8
Affects
astro

How it works

  • An attacker causes an Astro project to process an untrusted AVIF image.
  • Astro optimizes it through its default Sharp image service.
  • That service uses vulnerable libheif code.
  • Processing the image can let the attacker run code on the system.

What to do

Run npm list astro inside each Astro project. Versions below 7.2.8 are affected when the project processes untrusted AVIF images. Finding an affected version shows exposure, not evidence of an attack.

Run this in the application environment you want to check:

npm list astro

Upgrade Astro to version 7.2.8 or later. That release requires Sharp 0.35.4. Confirm npm list astro reports 7.2.8 or later afterward.

Technical details

GHSA-26w7-cxv4-gfx2 affects the Astro npm package before 7.2.8. A malicious AVIF image reaches vulnerable libheif code through Astro's default Sharp image service, potentially enabling remote code execution. Astro 7.2.8 fixes this exposure by requiring Sharp 0.35.4.

References