The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting (XSS) in websites enables Astro's client-side routing and has stored attacker-controlled scriptless HTML elements (i.e., iframe tags with unsanitized name attributes) on the destination pages. This vulnerability can result in cross-site scripting (XSS) attacks on websites that built with Astro that enable the client-side routing with ViewTransitions and store the user-inserted scriptless HTML tags without properly sanitizing the name attributes on the page. Version 4.16.1 contains a patch for this issue.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-79"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47885.json"
}{
"extracted_events": [
{
"cpe": "cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "3.0.0"
},
{
"fixed": "4.16.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "a4ffbfaa5cb460c12bd486fd75e36147f51d3e5e"
}
],
"source": "REFERENCES_COMMIT"
}
]
}