Live › vulnerability › CVE-2026-117183
astro-notion-blog (otoyo template, latest 0.13.0) downloads Notion FeaturedImage files at build time and writes them using the remote filename without keeping the path inside ./public/notion/. A Notion editor can overwrite project files and, per a public PoC write-up, get code execution on the build host. No fixed release exists as of 2026-10-30.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Sites built from otoyo/astro-notion-blog at 0.13.0 (the write-up says 0.6.1 to 0.13.0) that use the FeaturedImage downloader, where anyone other than you can edit the Notion database or supply image URLs. The impact lands on the machine or CI runner that runs the build, including its secrets. If only trusted people edit your Notion content, the risk is much lower; this is a build-time flaw, not a request to the live site.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| astro-notion-blog | npm | <= 0.13.0 | – |
0.13.0 is the latest release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL.
This page as .md · .json · in your agent: get_signal("CVE-2026-117183")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.