CVE-2025-59837

HIGH

astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-59837 has a selected CVSS score of 7.2 (high).

Description

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 29, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

astro

Browse withastro / astro
CVE List>= 5.13.4, < 5.13.10affected

astro

Browse npm / astro
GitHub Advisory5.13.4 to < 5.13.10 · Fixed in 5.13.10affected

References

5