漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Unauthorized third-party images in Astro’s _image endpoint
Vulnerability Description
Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include an /_image endpoint which returns optimized versions of images. A bug in impacted versions of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. /_image?href=//example.com/image.png. This vulnerability is fixed in 5.13.2 and 4.16.18.
CVSS Information
N/A
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
Astro 安全漏洞
Vulnerability Description
Astro是Astro开源的一个内容驱动网站的 web 框架。 Astro 5.13.2之前版本和4.16.18之前版本存在安全漏洞，该漏洞源于图像优化端点可能绕过第三方域名限制。
CVSS Information
N/A
Vulnerability Type
N/A