What is CVE-2025-59837?

CVE-2025-59837 is a high-severity vulnerability in Astro, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2025-10-28.

How severe is CVE-2025-59837?

High severity. CVSS v3 base score is 7.2 out of 10.

XSS in Astro

CVE-2025-59837

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (25.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Affected products

Astro
Withastro Astro — versions >= 5.13.4, < 5.13.10

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-59837?: CVE-2025-59837 is a high-severity vulnerability in Astro, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2025-10-28.
How severe is CVE-2025-59837?: High severity. CVSS v3 base score is 7.2 out of 10.