PT-2025-44205 · Astro · Astro

Published 2025-10-28 · Updated 2026-02-13 · CVE-2025-59837

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Astro versions 5.13.4 through 5.13.9

Description Astro’s image proxy has a domain validation bypass issue. Using backslashes in the href parameter can circumvent the validation, enabling server-side requests to arbitrary URLs. This can result in server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This issue is related to an incomplete fix for a previously identified problem.

Recommendations Update to Astro version 5.13.10 or later.

Exploit

Fix

XSS

SSRF

Weakness Enumeration

CWE-79

CWE-918

Related Identifiers

CVE-2025-59837

GHSA-QCPR-679Q-RHM2

Affected Products

Astro

References · 13

• 🔥 https://github.com/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59837.json · Exploit
• https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252 · Patch
• https://github.com/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4 · Patch
• https://osv.dev/vulnerability/CVE-2025-59837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59837 · Security Note
• https://osv.dev/vulnerability/GHSA-qcpr-679q-rhm2 · Vendor Advisory
• https://github.com/withastro/astro · Note
• https://twitter.com/CVEnew/status/1983267136115224875 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1oj4i5j/resumen_diario_de_vulnerabilidades_29102025 · Reddit Post
• https://twitter.com/transilienceai/status/2022151608310681784 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1983402437814690290 · Twitter Post
• https://t.me/CVEtracker/35994 · Telegram Post