CVE-2025-59837 - CVE House

Back to Database

Status published High CVE-2025-59837

astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

7.2 CVSS

Vulnerability Description

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59837

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from withastro

View All →

Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint

Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values

Astro is vulnerable to Reflected XSS via the server islands feature

Astro Development Server is Vulnerable to Arbitrary Local File Read

Affected Vendor

withastro

View all reports →

Affected Software

astro

Vulnerable Versions:

>= 5.13.4, < 5.13.10

Timeline

Official Publish: October 28th, 2025

Last Modified: October 29th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1046 Network Service Discovery

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1567 Exfiltration Over Web Service

T1491.001 Defacement