Astro - XSS (CVE-2025-64764)

CVE-2025-64764 is a reflected cross-site scripting (XSS) vulnerability in the Astro web framework, specifically affecting applications using the server islands feature prior to version 5.15.8. This flaw could allow remote attackers to inject and execute malicious scripts in the context of a user's browser, potentially leading to session hijacking or unauthorized actions on behalf of the user.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-64764 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2025-64764. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit the Astro server islands feature by sending crafted requests to URLs containing /_server-islands/ with malicious query parameters, resulting in reflected XSS payloads being executed in users' browsers.