{"uuid": "e5e161b0-327c-4c9e-929b-133fb25952ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-HP3V-MFQW-H74C", "type": "seen", "source": "https://gist.github.com/alon710/108624152e69003362bd827cbabc8c78", "content": "# GHSA-HP3V-MFQW-H74C: GHSA-hp3v-mfqw-h74c: Missing Character Escaping in @astrojs/netlify Remote Image Pattern Configuration\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/GHSA-HP3V-MFQW-H74C\n\n## Summary\nA security vulnerability in @astrojs/netlify allows attackers to bypass remote image path restrictions by leveraging unescaped regular expression metacharacters. The integration adapter fails to sanitize developer-defined pathnames before interpolating them into a configuration JSON file consumed by Netlify's Edge Image CDN. This results in overly permissive matching behavior at the edge routing layer, enabling path-traversal and filter bypasses.\n\n## TL;DR\nThe @astrojs/netlify adapter fails to escape dots and other regular expression metacharacters in developer-defined image pathnames, generating insecure edge configurations that permit attackers to bypass path-level restrictions on Netlify's Image CDN.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-185: Incorrect Regular Expression / CWE-116: Improper Output Escaping\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.7 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Filter Bypass / Resource Hijacking\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Astro applications deployed on Netlify using @astrojs/netlify < 8.1.2\n- **@astrojs/netlify**: < 8.1.2 (Fixed in: `8.1.2`)\n\n## Mitigation\n\n- Upgrade @astrojs/netlify integration to version 8.1.2 or higher\n- Avoid utilizing dot characters or special regular expression symbols inside pathnames in astro.config.mjs remotePatterns\n- Restrict the configured remotePatterns hostname to highly specific subdomains or folders to limit bypass surface\n\n**Remediation Steps:**\n1. Run 'npm install @astrojs/netlify@latest' (or equivalent package manager command) to update the package to version 8.1.2 or later\n2. Verify the output by building the project locally using 'npm run build'\n3. Examine the generated '.netlify/v1/config.json' and verify that dots in pathnames are preceded by double backslashes (e.g., '\\\\.')\n\n## References\n\n- [GitHub Security Advisory GHSA-hp3v-mfqw-h74c](https://github.com/withastro/astro/security/advisories/GHSA-hp3v-mfqw-h74c)\n- [Related Vulnerability GHSA-529g-xq4f-cw38 (CVE-2026-54300)](https://github.com/advisories/GHSA-529g-xq4f-cw38)\n- [Astro Pull Request #17018](https://github.com/withastro/astro/pull/17018)\n- [Main Astro Repository](https://github.com/withastro/astro)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-HP3V-MFQW-H74C) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T04:31:23.708180Z"}