CVE-2025-59837

astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

State: Published
Severity: 7.2 High
Published: Oct 28, 2025
Updated: Oct 29, 2025
Reserved: Sep 22, 2025

Description

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
astrowithastro	>= 5.13.4, < 5.13.10Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.