Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Related 2025 CVEs (e.g., CVE-2025-62784 in inventorygui, CVE-2025-59837 in Astro) appear for other software. The query references a social media post claiming use of Claude Code (likely Anthropic's Claude model with coding capabilities) to reverse-engineer Codex's Mac App. #AI #TechNews 💻
Post summary
The post mentions CVE identifiers and affected software but provides no further technical or contextual details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | astro | astro | - | node.js | - |