Vulnerability · Published Oct 28, 2025 · Assigned by GitHub_M
CVE-2025-59837astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
High 7.2
In plain English
A high-severity server-side request forgery in astro from withastro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | astro | 5.13.10 | GHSA-qcpr-679q-rhm2 |
Affected products (as reported)
Weakness: CWE-918, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N