1022 matches found
Malicious code in perseus-cassini-pm2-astro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eecf795ed972026476c3d217f8d763e7e2c89ff111b2dcd751985e8ac5aef90e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-111116
Malicious code in mini-css-extract-plugin-vega-astro-run-script npm...
EUVD-2025-120150
Malicious code in yakutsk-wasat-astro-auth npm...
EUVD-2025-122922
Malicious code in quito-phoebe-gemini-astro npm...
EUVD-2025-113436
Malicious code in framework-astro-library-wasat npm...
CVE-2025-59837
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...
@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +395 more potentially affected by CVE-2025-58179 +1 more via @astrojs/internal-helpers (>=0.0.0-markdoc-config-changes-20230626153541, <=0.7.2)
@astrojs/internal-helpers NPM version =0.0.0-markdoc-config-changes-20230626153541, =0.0.1, =1.0.0, =1.0.0, =0.0.17, =0.0.2, =0.2.0, =0.0.0-experimental-7c2f356, =0.0.0-experimental-7c2f356, =0.0.0-ast-20240419160649, =0.0.0-10745-20240410180016, =6.2.0, =4.1.0, =4.3.5 and more Source cves:...
CVE-2025-59837
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...
CVE-2025-59837 astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...
@astrojs/cloudflare (>=12.6.1, <=12.6.8), @astrojs/markdoc (>=0.15.3, <=0.15.6) +15 more potentially affected by CVE-2025-59837 via @astrojs/internal-helpers (>=0.7.0, <=0.7.2)
@astrojs/internal-helpers NPM version =0.7.0, =12.6.1, =0.15.3, =6.3.4, =4.3.2, =6.5.4, =9.3.2, =8.2.4, =0.0.1, =0.1.2-alpha.1, =1.13.2, =5.12.7, =1.1.2, =1.1.3 and more Source cves: CVE-2025-59837 Source advisory: MEND:CVE-2025-59837...
CVE-2025-59837 astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...
CVE-2025-59837
Astro (web framework) versions 5.13.4–5.13.9 vulnerable to image proxy domain validation bypass via backslashes in the href, enabling server-side requests to arbitrary URLs and potentially SSRF and XSS. Root cause: incomplete fix for CVE-2025-58179; fix implemented in 5.13.10. Affected component:...
@patternfly/patternfly-doc-core (1.15.1), joist-docs (>=1.267.1, <=1.271.0) potentially affected by CVE-2025-59837 via astro (>=5.13.4, <=5.13.5)
astro NPM version =5.13.4, =1.267.1, =1.271.0 Source cves: CVE-2025-59837 Source advisory: MEND:CVE-2025-59837...
CVE-2025-59837 astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...
@patternfly/patternfly-doc-core (1.15.1), joist-docs (>=1.267.1, <=1.271.0) potentially affected by CVE-2025-59837 via astro (>=5.13.4, <=5.13.5)
astro NPM version =5.13.4, =1.267.1, =1.271.0 Source cves: CVE-2025-59837 Source advisory: OSV:GHSA-QCPR-679Q-RHM2...
@patternfly/patternfly-doc-core (1.15.1), joist-docs (>=1.267.1, <=1.271.0) potentially affected by CVE-2025-59837 via astro (>=5.13.4, <=5.13.5)
astro NPM version =5.13.4, =1.267.1, =1.271.0 Source cves: CVE-2025-59837 Source advisory: GHSA-QCPR-679Q-RHM2...
Astro code issues and vulnerabilities
Astro is an Astro open source web framework for content-driven websites. A code issue vulnerability exists in Astro versions 5.13.4 through prior to 5.13.10, which stems from the use of a backslash in the href parameter to bypass image proxy domain validation, potentially leading to server-side...
CVE-2025-59837: Server-Side Request Forgery (SSRF)
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...
CVE-2025-61925
Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in X-Forwarded-Host in output when using Astro.url without any validation. It is common for web servers such as nginx to route requests via the Host header, and forward on other request headers. As such as malicious reque...