CVE-2025-59837

Description

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

PUBLISHED Reserved 2025-09-22 | Published 2025-10-28 | Updated 2025-10-29 | Assigner GitHub_M

Problem types

CWE-918: Server-Side Request Forgery (SSRF)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/.../astro/security/advisories/GHSA-qcpr-679q-rhm2

github.com/...ommit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4

github.com/...ommit/9ecf3598e2b29dd74614328fde3047ea90e67252

cve.org (CVE-2025-59837)

nvd.nist.gov (CVE-2025-59837)

Download JSON