CVE-2025-59837 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using b…
High CVSS: 7.2

CVE-2025-59837

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.
Vendor
Astro
Product
Astro
CWE
CWE-79
Yayın Tarihi
2025-10-28 20:15:49
Güncelleme
2025-11-25 15:16:15
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-79 Astro HIGH Astro 2025

Referanslar

https://github.com/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4 https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252 https://github.com/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2