Packages / astro / Security

HighVulnerabilityGHSA-qcpr-679q-rhm2Published 28 Oct 2025

Astro's bypass of image proxy domain validation leads to SSRF and potential XSS

Affected · astro

  • >= 5.13.4, < 5.13.10

Fixed in

5.13.10

npm install astro@5.13.10

  1. Not affected

    0.0.1 – 5.13.3

    600 releases

  2. Affected

    5.13.4 – 5.13.9

    6 releases

  3. Fixed

    5.13.10 – 7.4.1

    124 releases, latest

730 stable releases of astro, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.