CVE-2025-59837

HIGH

Astro 5.13.4-5.13.9 - Server-Side Request Forgery via Backslash Bypass in Image Proxy

Title source: llm
STIX 2.1

Description

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

References (3)

Core 3

Scores

CVSS v3 7.2
EPSS 0.0032
EPSS Percentile 23.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-79 CWE-918
Status published
Products (2)
astro/astro 5.13.4 - 5.13.10
npm/astro 5.13.4 - 5.13.10npm
Published Oct 28, 2025
Tracked Since Feb 18, 2026