{"action":"Upgrade astro to 5.13.10 or later.","affected":[{"fixed":"5.13.10","introduced":"5.13.4"}],"component":"astro","cve_ids":["CVE-2025-59837"],"ecosystem":"npm","epss":0.00351,"exploited":false,"fixed_versions":["5.13.10"],"ghsa_id":"GHSA-qcpr-679q-rhm2","id":"tcs_01M5KG5XYT5QET48DWHPR42E4B","modified_at":"2025-10-29T14:48:45Z","published_at":"2025-10-28T17:45:04Z","references":["https://osv.dev/vulnerability/GHSA-qcpr-679q-rhm2","https://github.com/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2","https://nvd.nist.gov/vuln/detail/CVE-2025-59837","https://github.com/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4","https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252","https://github.com/withastro/astro"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-qcpr-679q-rhm2","url":"https://osv.dev/vulnerability/GHSA-qcpr-679q-rhm2"}],"summary":"Astro's bypass of image proxy domain validation leads to SSRF and potential XSS"}