The vulnerability resides in the @astrojs/cloudflare adapter, where the fetch() call used for remote images follows HTTP redirects by default. This bypasses the isRemoteAllowed() domain allowlist which only validates the initial URL, enabling the Cloudflare Worker to request arbitrary URLs. The result is an SSRF condition that could allow an attacker to access internal network resources, causing potential confidentiality and availability impacts.

Vendors and products affected are the withastro collection, specifically the @astrojs/cloudflare adapter. Any installation using versions earlier than 13.1.10 is vulnerable. Versions 13.1.10 and later contain the fix.

The CVSS base score is 2.2, indicating a low severity, and the EPSS score is below 1%, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to execute JavaScript in the Cloudflare Worker context, which is a typical remote code path for the adapter. Because the flaw arises from automatic redirection handling, an attacker can simply supply a malicious URL to trigger the redirect cycle. However, due to the low exploitation probability, this vulnerability is unlikely to see widescale use, but should still be remediated promptly.