CVE-2025-59837

HIGH EPSS 23.8%
Published Oct 28, 20258mo ago · Modified Jun 17, 20262w ago
7.2 CVSS 3.1
High
Find Similar
Published Oct 28, 2025 8mo ago
Last Modified Jun 17, 2026 2w ago

Description

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

CVSS Details

Base Score
7.2
Exploitability
3.9
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
23.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-79 Cross-site Scripting Injection
CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 1

VendorProductVersionRange
astroastro*≥5.13.4  –  <5.13.10

References 3

  • github.com https://github.com/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4
    Patch
  • github.com https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252
    Patch
  • github.com https://github.com/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4
    Patch
  • github.com https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252
    Patch