CVE-2025-59837: falha de alta gravidade em withastro astro
astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2epss 0.4%
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
withastro · astroCVEs relacionadas — withastro astro
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25545MEDIUMAstro has Full-Read SSRF in error rendering via Host: header injectionEPSS 1.9%CVE-2024-56159HIGHServer source code is exposed to the public if sourcemaps are enabledEPSS 1.5%CVE-2025-64525MEDIUMAstro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypassEPSS 1.2%CVE-2025-58179HIGHAstro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpointEPSS 0.9%CVE-2026-84376MEDIUMAstro: Authorization bypass from missing path-segment boundary check when stripping the configured baseEPSS 0.7%CVE-2025-54793MEDIUMAstro: Duplicate trailing slash feature can lead to Open RedirectsEPSS 0.7%