Critical severity9.8NVD Advisory· Published May 19, 2026· Updated May 20, 2026

CVE-2026-30117

Description

scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalar_url query parameter of the Scalar Proxy endpoint. This vulnerability allows attackers to execute arbitrary code via uploading a crafted SVG file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Prassan10/XSS Open Redirect Via Scalar URLreferences
Withastro/Astrollm-fuzzy
Range: = 0.1.13

Patches

Vulnerability mechanics

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000