{"id":"GHSA-26w7-cxv4-gfx2","aliases":[],"url":"https://o3.security/vulnerability/GHSA-26w7-cxv4-gfx2","summary":"Astro: Remote code execution through AVIF image optimization","details":"A vulnerability in `libheif`, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.\n\nProjects are affected when an attacker can cause Astro to process an untrusted AVIF image.\n\nThe fix was released in Astro 7.2.8, which requires Sharp 0.35.4.","published":"2026-09-08T21:26:16Z","modified":"2026-09-08T21:30:05.563003658Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"astro","fixedVersion":"7.2.8"}],"fix":{"url":"https://github.com/withastro/astro/commit/ecb4082131490b4fe9a56aa44fda84b54ef8967b","label":"withastro/astro@ecb4082"},"references":[{"type":"WEB","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497"},{"type":"WEB","url":"https://github.com/withastro/astro/security/advisories/GHSA-26w7-cxv4-gfx2"},{"type":"WEB","url":"https://github.com/withastro/astro/commit/ecb4082131490b4fe9a56aa44fda84b54ef8967b"},{"type":"PACKAGE","url":"https://github.com/withastro/astro"},{"type":"WEB","url":"https://github.com/withastro/astro/releases/tag/astro@7.2.8"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-08T21:30:05.563003658Z"}}