{"action":"Upgrade astro to 7.2.8 or later.","affected":[{"fixed":"7.2.8","introduced":"0"}],"component":"astro","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["7.2.8"],"ghsa_id":"GHSA-26w7-cxv4-gfx2","id":"tcs_01M5KES6B0R1WC95TSE2VG9XYW","modified_at":"2026-09-08T21:30:05.563003658Z","published_at":"2026-09-08T21:26:16Z","references":["https://osv.dev/vulnerability/GHSA-26w7-cxv4-gfx2","https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497","https://github.com/withastro/astro/security/advisories/GHSA-26w7-cxv4-gfx2","https://github.com/withastro/astro/commit/ecb4082131490b4fe9a56aa44fda84b54ef8967b","https://github.com/withastro/astro","https://github.com/withastro/astro/releases/tag/astro@7.2.8"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-26w7-cxv4-gfx2","url":"https://osv.dev/vulnerability/GHSA-26w7-cxv4-gfx2"}],"summary":"Astro: Remote code execution through AVIF image optimization"}