Astro's bypass of image proxy domain validation leads to SSRF and potential XSS

ALTO 7.2CVE-2025-59837 · GHSA-qcpr-679q-rhm2 · Published 28/10/2025 · updated 08/10/2026

In breve

CVE-2025-59837 è una vulnerabilità ALTO (CVSS 7.2) che riguarda astro (astro), astro.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.35%, superiore al 28.8% delle vulnerabilità.
Correzione: aggiornare a 5.13.10 o successiva.

Package	Affected versions	Patched versions
astro astro	`≥ 5.13.4, < 5.13.10`	`5.13.10`
astro npm	`≥ 5.13.4, < 5.13.10`	`5.13.10`

Description

Summary

This is a patch bypass of CVE-2025-58179 in commit 9ecf359. The fix blocks http://, https:// and //, but can be bypassed using backslashes (\) - the endpoint still issues a server-side fetch.

PoC

https://astro.build/_image?href=\raw.githubusercontent.com/projectdiscovery/nuclei-templates/refs/heads/main/helpers/payloads/retool-xss.svg&f=svg

NVD description

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

References

withastro/astro security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-59837 · ADVISORY
withastro/astro commit 1e2499e · WEB
withastro/astro commit 9ecf359 · WEB
withastro/astro · PACKAGE

Altre vulnerabilità di astro

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

astro

≥ 5.13.4, < 5.13.10

5.13.10

astro

npm

≥ 5.13.4, < 5.13.10

5.13.10

Description

NVD description

Altre vulnerabilità di astro

Vedi tutto →