CVE-2024-47885

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting (XSS) in websites enables Astro's client-side routing and has *stored* attacker-controlled scriptless HTML elements (i.e., `iframe` tags with unsanitized `name` attributes) on the destination pages. This vulnerability can result in cross-site scripting (XSS) attacks on websites that built with Astro that enable the client-side routing with `ViewTransitions` and store the user-inserted scriptless HTML tags without properly sanitizing the `name` attributes on the page. Version 4.16.1 contains a patch for this issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
withastroastro>=3.0.0, < 4.16.1
withastroastro>= 3.0.0, < 4.16.1

References

Timeline

Published
Oct 14, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-478867.2Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code executiCVE-2024-478876.6Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.CVE-2024-478886.6Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.CVE-2024-478896.6Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, CVE-2024-47896.4Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demCVE-2024-478917.8Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.CVE-2024-478927.8Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.CVE-2024-478936.5Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside thCVE-2024-478947.1Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtCVE-2024-478957.1Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtCVE-2024-478963.3Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's viCVE-2024-478978.8Software installed and run as a non-privileged user may conduct improper GPU system calls resulting in platform instability and reboots.