CVE-2026-59731

{
  "id": "CVE-2026-59731",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T17:17:25.937",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8."
    },
    {
      "lang": "es",
      "value": "Astro es un framework web para sitios web basados en contenido. La versión 6.4.7 toma decisiones de autorización sobre un ’pathname’ parcialmente decodificado después de alcanzar el límite del decodificador de URL iterativo, mientras que la coincidencia de rutas de reescritura posterior realiza una operación ’decodeURI()’ adicional y puede resolver la solicitud a una ruta protegida. Este problema se corrige en la versión 6.4.8."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "withastro",
          "product": "astro",
          "versions": [
            {
              "version": ">= 6.4.7, < 6.4.8",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-09T14:38:51.210895Z",
          "id": "CVE-2026-59731",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-647"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/withastro/astro/pull/17109",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/withastro/astro/releases/tag/[email protected]",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}