CVE-2025-59837: astro — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2025-59837

CVSS 7.2 · High EPSS 0,35%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada astro. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

Rincian

Terbit di NVD: 28 Oktober 2025
Terakhir diubah: 8 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,35% peluang dieksploitasi; lebih tinggi dari 26,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
astro	astro	Versi 5.13.4 hingga sebelum 5.13.10

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4 patch
https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252 patch
https://github.com/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2 exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 00:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.