CVE-2025-59837 json
astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
published 2025-10-28 12 mo ago modified 2026-10-08 32 d ago also EUVD-2025-36542 , GHSA-qcpr-679q-rhm2
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.
Patch / fix
- npm astro 5.13.10
- astro astro 5.13.10
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | astro | >=5.13.4, <5.13.10 |
5.13.10 |
Affected products
- withastro astro
Classification
References
-
github.com
/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4
web, patch
-
github.com
/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252
web, patch
-
github.com
/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-59837
advisory
-
github.com
/withastro/astro
package
Sources
- CVE List CVE-2025-59837
- GitHub Advisory GHSA-qcpr-679q-rhm2
- NVD CVE-2025-59837
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.