CVE-2025-64764: 
JavaScript vulnerability analysis and mitigation

CVE-2025-64764 is a reflected Cross-Site Scripting (XSS) vulnerability in the Astro web framework affecting all versions up to and including 5.15.6 for Node.js. The flaw exists in the server islands feature and allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser, regardless of the component template used. It was discovered by researchers Allam Rachid (zhero;) and Allam Yasser (inzo), disclosed and patched on November 19, 2025. The CNA (GitHub) assigned a CVSS v3.1 score of 7.1 (High), while NVD assessed it at 5.4 (Medium) (Github Advisory, Astro Security Advisory).

The vulnerability is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) and CWE-79 (Cross-site Scripting). Server islands in Astro handle hydration requests via the endpoint /_server-islands/[name], accepting three URL parameters: e (component export), p (encrypted properties), and s (slots). When the e parameter is set to file, the framework returns the absolute path of the island file as a string and constructs an independent HTML template using markHTMLString, injecting the s (slots) parameter value as a child element without proper sanitization. This allows an attacker to supply a crafted s parameter containing an XSS payload (e.g., {"key":"<img src=x onerror=alert(0)>"}), which is reflected directly into the rendered HTML response. The vulnerability is exploitable even when the targeted server island component template is completely empty, making it universal across any Astro application using the server islands feature (Astro Security Advisory, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who clicks a crafted link targeting a vulnerable Astro application. This can result in session cookie theft, credential harvesting, manipulation of page content, and performing unauthorized actions on behalf of the victim. The integrity impact is rated High by the CNA, reflecting the ability to significantly alter page content and user interactions, while confidentiality impact is Low (limited data exposure without further chaining). Availability is not impacted (Astro Security Advisory).

A public proof-of-concept (PoC) was included in the security advisory at the time of disclosure, demonstrating exploitation via a crafted URL targeting the /_server-islands/[name] endpoint (Astro Security Advisory). Nuclei detection templates for this CVE were added to the ProjectDiscovery nuclei-templates repository shortly after disclosure, further lowering the barrier for automated scanning (Feedly). No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.19–0.24%, placing it in the 48th percentile for exploitation likelihood. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify Astro-based web applications using the server islands feature (versions ≤ 5.15.6). This can be done by looking for the /_server-islands/ path pattern in HTTP responses or via passive scanning tools.
2. Identify a valid island name: Browse the target application to find a page that uses a server island component. The component name (e.g., ServerTime) will be visible in network requests to /_server-islands/[name].
3. Craft the malicious URL: Construct a GET request to the server islands endpoint with the e parameter set to file, an empty p parameter, and the s parameter containing a JSON-encoded XSS payload:

   http://target.example.com/_server-islands/ServerTime?e=file&p=&s={"zhero":"<img src=x onerror=alert(document.cookie)>"}

4. Deliver the payload: Send the crafted URL to a victim user via phishing email, social engineering, or embedding in a malicious page. User interaction (clicking the link) is required.
5. Script execution: When the victim's browser loads the URL, the Astro server reflects the unsanitized slot content into the HTML response, causing the injected script to execute in the victim's browser context — enabling session theft, credential harvesting, or further attacks (Astro Security Advisory, Github Advisory).

• Network: Unusual GET or POST requests to /_server-islands/[name] with the e parameter set to file and the s parameter containing HTML tags or JavaScript event handlers (e.g., onerror, onload, <script>).
• Logs: Web server access logs showing requests to /_server-islands/ endpoints with URL-encoded HTML payloads in the s query parameter (e.g., %3Cimg, %3Cscript, onerror=).
• Network: Outbound requests from victim browsers to attacker-controlled infrastructure (e.g., cookie exfiltration endpoints) following interaction with a crafted server islands URL.

Upgrade Astro to version 5.15.8 or later, which resolves the vulnerability by properly escaping the pathname value used in the template rendering (commit 790d9425f39bbbb462f1c27615781cd965009f91) (Astro Security Advisory, Patch Commit). As a temporary workaround if upgrading is not immediately possible, implement a Content Security Policy (CSP) to restrict inline script execution, and consider blocking or rate-limiting requests to the /_server-islands/ endpoint at the WAF or reverse proxy level. Disabling the server islands feature entirely will also eliminate the attack surface.

The vulnerability was credited to researchers Allam Rachid (zhero;) and Allam Yasser (inzo), who provided a detailed technical write-up and PoC in the GitHub security advisory (Astro Security Advisory). ProjectDiscovery added a Nuclei detection template for CVE-2025-64764 to their community templates repository, indicating recognition of the vulnerability's scanning relevance within the security community (Feedly). The vulnerability was also highlighted in ProjectDiscovery's November 2025 Nuclei templates blog post.