Astro's bypass of image proxy domain validation leads to SSRF and potential XSS

概要

参考情報

• withastro/astro security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-59837 · ADVISORY
• withastro/astro commit 1e2499e · WEB
• withastro/astro commit 9ecf359 · WEB
• withastro/astro · PACKAGE

astro のその他の脆弱性

• CVE-2026-54299高 7.5Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fet…
• CVE-2026-54298中 6.1Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys …
• CVE-2026-50146中 6.1Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-tem…
• CVE-2026-45028中 6.1Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server isla…
• CVE-2026-41067中 6.1Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive rege…