{"id":"GHSA-26w7-cxv4-gfx2","title":"Astro: Remote code execution through AVIF image optimization","summary":"Astro: Remote code execution through AVIF image optimization","severity":"critical","cvss":9.8,"cwe":["CWE-125","CWE-787"],"vendor":"astro","product":"astro","ecosystem":"npm","affected":["astro < 7.2.8"],"patched":["astro 7.2.8"],"published":"2026-09-08","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:26:18Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-26w7-cxv4-gfx2","references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497"},{"url":"https://github.com/withastro/astro/security/advisories/GHSA-26w7-cxv4-gfx2"},{"url":"https://github.com/withastro/astro/commit/ecb4082131490b4fe9a56aa44fda84b54ef8967b"},{"url":"https://github.com/withastro/astro/releases/tag/astro@7.2.8"},{"url":"https://github.com/advisories/GHSA-26w7-cxv4-gfx2"}],"tags":["ghsa","npm"],"ingestedAt":"2026-09-08T22:12:30.968Z","slug":"GHSA-26w7-cxv4-gfx2","body":"## Overview\n\nA vulnerability in `libheif`, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.\n\nProjects are affected when an attacker can cause Astro to process an untrusted AVIF image.\n\nThe fix was released in Astro 7.2.8, which requires Sharp 0.35.4.\n\n## Affected packages\n\n- `astro < 7.2.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `astro 7.2.8`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}