# CVE-2025-55303: Astro - XSS

> Live exploitation tracking for CVE-2025-55303 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-55303

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.9
- **Public exploit available:** Yes
- **Affected products:** WithAstro Astro
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')); CWE-115 (Misinterpretation of Input)
- **Tags:** web_application, javascript

## Description

Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include an /_image endpoint which returns optimized versions of images. A bug in impacted versions of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. /_image?href=//example.com/image.png. This vulnerability is fixed in 5.13.2 and 4.16.18.

## CrowdSec analysis

[CVE-2025-55303](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-55303) is a vulnerability in the Astro web framework that allows attackers to bypass domain restrictions on the image optimization endpoint, enabling unauthorized third-party images to be served via protocol-relative URLs. This flaw could be exploited to facilitate cross-site scripting (XSS) or content injection attacks, potentially compromising the security of content-driven websites built with affected versions of Astro.

CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.

CrowdSec network observations suggest that most exploitation of CVE-2025-55303 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2025-55303 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the image optimization endpoint by sending requests to URLs containing `/_image?href=//` followed by a third-party domain, allowing unauthorized access to external images. This targets Astro deployments with on-demand rendering and can lead to information disclosure or content spoofing.

## Timeline

- 2025-08-19: CVE Published. CVE-2025-55303 is published to NVD.
- 2026-02-11: Rule Released. CrowdSec releases a rule to detect CVE-2025-55303 exploitation attempts against the CrowdSec Network.
- 2026-02-12: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-55303 for the first time.

## References

- https://github.com/withastro/astro/commit/4d16de7f95db5d1ec1ce88610d2a95e606e83820
- https://github.com/withastro/astro/security/advisories/GHSA-xf8x-j4p2-f749
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55303.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-55303) follows observed exploitation activity for CVE-2025-55303. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.