Astro: Remote code execution through AVIF image optimization
Astro can run attacker code while optimizing a malicious AVIF image. The project must accept and process an image the attacker controls.
- Severity
- CriticalCVSS 9.8
- Fix
- Fixed in 7.2.8Fix recorded 3 days ago
- Affected versions
- before 7.2.8
- Affects
- astro
How it works
- An attacker causes an Astro project to process an untrusted AVIF image.
- Astro optimizes it through its default Sharp image service.
- That service uses vulnerable libheif code.
- Processing the image can let the attacker run code on the system.
What to do
Run npm list astro inside each Astro project. Versions below 7.2.8 are affected when the project processes untrusted AVIF images. Finding an affected version shows exposure, not evidence of an attack.
Run this in the application environment you want to check:
npm list astroUpgrade Astro to version 7.2.8 or later. That release requires Sharp 0.35.4. Confirm npm list astro reports 7.2.8 or later afterward.
Technical details
GHSA-26w7-cxv4-gfx2 affects the Astro npm package before 7.2.8. A malicious AVIF image reaches vulnerable libheif code through Astro's default Sharp image service, potentially enabling remote code execution. Astro 7.2.8 fixes this exposure by requiring Sharp 0.35.4.
References
- github.com · astro@7.2.8 (tag) vendor advisory patch release notes
- github.com · commit ecb4082 vendor advisory GitHub Advisory
- github.com · GHSA-g89c-p67h-r497 vendor advisory
- github.com · GHSA-26w7-cxv4-gfx2 vendor advisory
- osv.dev · GHSA-26W7-CXV4-GFX2 vdb entry