What is CVE-2025-64764?

CVE-2025-64764 is a high-severity vulnerability in Astro, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 7.1/10. Published 2025-11-19.

How severe is CVE-2025-64764?

High severity. CVSS v3 base score is 7.1 out of 10.

XSS in Astro

CVE-2025-64764

Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.

EPSS: 0.005 (40.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N.

Affected products

Astro
Withastro Astro — versions < 5.15.8

Weakness classification (CWE)

CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-64764?: CVE-2025-64764 is a high-severity vulnerability in Astro, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 7.1/10. Published 2025-11-19.
How severe is CVE-2025-64764?: High severity. CVSS v3 base score is 7.1 out of 10.