Detections
Analytics

SCA: security update for astro (GHSA-x3h8-62x9-952g)

low Tenable Cloud Security Plugin ID 436118

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro
 framework's development server that allows arbitrary local file read access through the image optimization
 endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any
 image file accessible to the Node.js process on the host system. This issue has been patched in version
 5.14.3. (CVE-2025-64757)

See Also

https://github.com/advisories/GHSA-x3h8-62x9-952g

Plugin Details

Severity: Low

ID: 436118

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 11/20/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.6

Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2025-64757

CVSS v3

Risk Factor: Low

Base Score: 3.5

Temporal Score: 3.2

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/19/2025

Vulnerability Publication Date: 11/19/2025

Reference Information

CVE: CVE-2025-64757