What is CVE-2025-59837?

CVE-2025-59837 is a high-severity vulnerability in Astro, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2025-10-28.

How severe is CVE-2025-59837?

High severity. CVSS v3 base score is 7.2 out of 10.

XSS in Astro

CVE-2025-59837

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2025-10-28 · last modified 2026-10-08.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.004 (27.2th percentile), scored 2026-10-19.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 27.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.000

Affected products

Astro
Withastro Astro — versions >= 5.13.4, < 5.13.10

Weakness classification (CWE)

References

github.com/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2 (Exploit, Third Party Advisory)
github.com/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4 (Patch)
github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252 (Patch)

Frequently asked questions

What is CVE-2025-59837?: CVE-2025-59837 is a high-severity vulnerability in Astro, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2025-10-28.
How severe is CVE-2025-59837?: High severity. CVSS v3 base score is 7.2 out of 10.