# Astro vulnerable to reflected XSS via the server islands feature

Astro server islands endpoint accepts e=file and an attacker-controlled slot in s, reflecting an XSS payload regardless of the component template.

- Payout: Research
- Severity: high
- Program: Astro
- Found by: cold-try
- Disclosed: 2025-11-19
- CVE: CVE-2025-64764
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wrwg-2hg8-v723
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-wrwg-2hg8-v723
- Tags: area:web domain:web impact:integrity kind:research platform:ghsa sev:high tech:nodejs technique:source-review vuln:xss

**Target:** /_server-islands/[name] HTTP endpoint
**Root cause:** The server islands endpoint accepts an undocumented `e=file` export that returns the island's absolute path as a string; the renderer then builds a template using that path as tag name and injects the `s` slot value as child via markHTMLString without escaping.
**Steps:**
1. Deploy an Astro app (<=5.15.6) using server islands with any component, even an empty one.
2. Request `/_server-islands/ServerTime?e=file&p=&s={"zhero":"<img src=x onerror=alert(0)>"}`.
3. Observe the popup: the `s` JSON value is rendered as a child of a tag named after the island file path.
**How found:** Researcher enumerated the `e` parameter values beyond the default `default`, discovering `url` and `file`; noted `file` returns a string, which satisfies the branch in component.ts that builds a template from the path and injects childSlots via markHTMLString.
**Exploitation:** Attacker crafts a URL to the server islands endpoint with `e=file` and an XSS payload as a JSON value in `s`; victim visiting the link executes script in the app origin.
**Insight:** Server island endpoints expose multiple export modes (`default`, `url`, `file`); the `file` mode returns a raw path string that flows into template construction, so any user-controlled slot value becomes HTML — probe undocumented parameter enum values on framework hydration endpoints.

## Proof of concept (copied exactly from the original report)

**Reflected XSS via server islands URL**

```
http://localhost:4321/_server-islands/ServerTime?e=file&p=&s={%22zhero%22:%22%3Cimg%20src=x%20onerror=alert(0)%3E%22}
```