CVE-2026-59731

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59731", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-06T15:34:16.917Z", "datePublished": "2026-07-08T16:27:18.496Z", "dateUpdated": "2026-07-09T14:38:54.995Z"}, "containers": {"cna": {"title": "Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch", "problemTypes": [{"descriptions": [{"cweId": "CWE-647", "lang": "en", "description": "CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"}, {"name": "https://github.com/withastro/astro/pull/17109", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/pull/17109"}, {"name": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785"}, {"name": "https://github.com/withastro/astro/releases/tag/astro@6.4.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/releases/tag/astro@6.4.8"}], "affected": [{"vendor": "withastro", "product": "astro", "versions": [{"version": ">= 6.4.7, < 6.4.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T16:27:18.496Z"}, "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8."}], "source": {"advisory": "GHSA-vj59-8hwv-xxmv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T14:38:51.210895Z", "id": "CVE-2026-59731", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:38:54.995Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59731", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:38:51.210895Z"}}}], "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:38:42.917Z"}}], "cna": {"title": "Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch", "source": {"advisory": "GHSA-vj59-8hwv-xxmv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "withastro", "product": "astro", "versions": [{"status": "affected", "version": ">= 6.4.7, < 6.4.8"}]}], "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv", "name": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/withastro/astro/pull/17109", "name": "https://github.com/withastro/astro/pull/17109", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785", "name": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/withastro/astro/releases/tag/astro@6.4.8", "name": "https://github.com/withastro/astro/releases/tag/astro@6.4.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-647", "description": "CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T16:27:18.496Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59731", "state": "PUBLISHED", "dateUpdated": "2026-07-09T14:38:54.995Z", "dateReserved": "2026-07-06T15:34:16.917Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T16:27:18.496Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "astro", "vendor": "withastro", "versions": [{"status": "affected", "version": ">= 6.4.7, < 6.4.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8."}, {"lang": "es", "value": "Astro es un framework web para sitios web basados en contenido. La versi\u00f3n 6.4.7 toma decisiones de autorizaci\u00f3n sobre un \u2019pathname\u2019 parcialmente decodificado despu\u00e9s de alcanzar el l\u00edmite del decodificador de URL iterativo, mientras que la coincidencia de rutas de reescritura posterior realiza una operaci\u00f3n \u2019decodeURI()\u2019 adicional y puede resolver la solicitud a una ruta protegida. Este problema se corrige en la versi\u00f3n 6.4.8."}], "id": "CVE-2026-59731", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59731", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T14:38:51.210895Z", "version": "2.0.3"}}]}, "published": "2026-07-08T17:17:25.937", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/pull/17109"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/releases/tag/astro@6.4.8"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-647"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.4.7,6.4.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "astro", "source": "cna", "vendor": "withastro"}, "product": "astro", "vendor": "withastro"}], "created": "2026-07-08T18:30:06.315341+00:00", "updated": "2026-08-01T16:00:05.134428+00:00", "vendors": ["withastro", "withastro$PRODUCT$astro"]}