CVE-2025-59837

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-59837

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59837.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-59837

Aliases

GHSA-qcpr-679q-rhm2

Published

2025-10-28T19:54:28.683Z

Modified

2025-12-05T10:21:00.334925Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

Details

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

Database specific

{
    "cwe_ids": [
        "CWE-79",
        "CWE-918"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59837.json"
}

References

Affected packages

Git / github.com/withastro/astro

Affected ranges

Type: GIT
Repo: https://github.com/withastro/astro
Events: Introduced

24b04c159ff2e5e1b15efcf8f3a77a131b5a9f92

Fixed

29ff12f2052bcc2ef130f538e10c60b7461f0d53

Affected versions

@astrojs/alpinejs@0.*

@astrojs/alpinejs@0.4.9

@astrojs/cloudflare@12.*

@astrojs/cloudflare@12.6.6

@astrojs/cloudflare@12.6.7

@astrojs/cloudflare@12.6.8

@astrojs/db@0.*

@astrojs/db@0.17.2

@astrojs/db@0.18.0

@astrojs/markdoc@0.*

@astrojs/markdoc@0.15.6

@astrojs/mdx@4.*

@astrojs/mdx@4.3.5

@astrojs/netlify@6.*

@astrojs/netlify@6.5.10

@astrojs/netlify@6.5.9

@astrojs/preact@4.*

@astrojs/preact@4.1.1

@astrojs/react@4.*

@astrojs/react@4.3.1

@astrojs/sitemap@3.*

@astrojs/sitemap@3.6.0

@astrojs/solid-js@5.*

@astrojs/solid-js@5.1.1

@astrojs/svelte@7.*

@astrojs/svelte@7.1.1

@astrojs/vercel@8.*

@astrojs/vercel@8.2.7

@astrojs/vue@5.*

@astrojs/vue@5.1.1

astro@5.*

astro@5.13.4

astro@5.13.5

astro@5.13.6

astro@5.13.7

astro@5.13.8

astro@5.13.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59837.json"