Repository navigation
Upgrade astro in website/site: 5.14 carries a critical RCE and three highs #1037
Description
Aikido's scan of #1035 reports one new CRITICAL in this repository and it is astro in website/site:
| advisory | severity | fixed in |
|---|---|---|
| Remote code execution through AVIF image optimization | CRITICAL | astro >= 7.2.8 |
| Reflected XSS via unescaped slot name | HIGH | >= 6.3.3 |
| Host header SSRF in prerendered error page fetch | HIGH | >= 6.4.6 |
The website currently pins "astro": "^5.14.0". The fixes are a major-version jump, so this is not something to fold into a branch-sync PR (it arrived on main with #1035, and main carries the same version today).
Also flagged at the same scan, in the same dependency tree: sharp (>= 0.35.5), follow-redirects (>= 1.16.2), browserslist (>= 4.28.7), body-parser (>= 1.20.9) — all HIGH, all reachable from website/site's own lockfile.
Scope: bump the website's dependencies, confirm astro build and astro check still pass, and check nothing in src/ imports an API the majors removed.
Activity
avantikonde commentedon Nov 3, 2026
Hi @cameri @chappie-daemon ,
Since PR #1038 already merged the core
astro7.4.4 andsharp0.35.5 upgrades intomain, this issue can likely be closed.For the remaining
astro checkerrors and deprecation warnings left from the migration, I have a small clean-up branch ready on top of latestmain:astro checkerrors viawebsite/site/src/env.d.ts(Fetcherandnavigator.connection).markdown.processor: unified({...})API inastro.config.mjs.website/sitenode engine with repo root (>=24.14.1).Since repository interaction limits prevent opening a PR directly, could someone open a PR from or cherry-pick:
https://github.com/avantikonde/nostream/tree/fix/upgrade-astrohttps://github.com/cameri/nostream/compare/main...avantikonde:fix/upgrade-astro