CVE-2025-59837 HIGH

CVE-2025-59837: astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

Vendor Withastro
Product astro
Weakness CWE-918 · SSRF
Published October 28, 2025
Last update October 29, 2025
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

Key dates

02Disclosure timeline

October 28, 2025 CVE published
October 29, 2025 Record updated