Astro - XSS (CVE-2025-64764)

CVE-2025-64764 is a reflected cross-site scripting (XSS) vulnerability in the Astro web framework, specifically affecting applications using the server islands feature prior to version 5.15.8. This flaw could allow remote attackers to inject and execute malicious scripts in the context of a user's browser, potentially leading to session hijacking or unauthorized actions on behalf of the user.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2025-64764 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. CrowdSec network telemetry also shows that exploitation of CVE-2025-64764 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the Astro server islands feature by sending crafted requests to URLs containing /_server-islands/ with malicious query parameters, resulting in reflected XSS payloads being executed in users' browsers.