Astro - XSS (CVE-2025-55303)

CVE-2025-55303 is a vulnerability in the Astro web framework that allows attackers to bypass domain restrictions on the image optimization endpoint, enabling unauthorized third-party images to be served via protocol-relative URLs. This flaw could be exploited to facilitate cross-site scripting (XSS) or content injection attacks, potentially compromising the security of content-driven websites built with affected versions of Astro.

CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.

CrowdSec network observations suggest that most exploitation of CVE-2025-55303 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2025-55303 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the image optimization endpoint by sending requests to URLs containing /_image?href=// followed by a third-party domain, allowing unauthorized access to external images. This targets Astro deployments with on-demand rendering and can lead to information disclosure or content spoofing.