Astro's bypass of image proxy domain validation leads to SSRF and potential XSS

Mô tả

Tham khảo

• withastro/astro security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-59837 · ADVISORY
• withastro/astro commit 1e2499e · WEB
• withastro/astro commit 9ecf359 · WEB
• withastro/astro · PACKAGE

Lỗ hổng khác của astro

• CVE-2026-54299CAO 7.5Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fet…
• CVE-2026-54298TRUNG BÌNH 6.1Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys …
• CVE-2026-50146TRUNG BÌNH 6.1Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-tem…
• CVE-2026-45028TRUNG BÌNH 6.1Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server isla…
• CVE-2026-41067TRUNG BÌNH 6.1Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive rege…