Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@astrojs/rss

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3npmAmendedPublished

    @astrojs/rss: XML Injection via Unescaped RSS Feed Fields

    CVE-2026-59728 · GHSA-8j5q-mfj2-5q9q

    Affected
    • npm @astrojs/rss >= 1.0.0, < 4.0.19
    Fixed in
    4.0.19· Vendor fix available
    Issue
    In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS feed. Details Two fields in packages/astro-rss/src/index.ts are affected: source.title source.title is validated only as z.string(), with no restriction on XML special characters. A value containing </source followed by arbitrary XML is parsed as real XML elements, merging injected nodes into the RSS item. enclosure.type enclosure.type is also z.string() and is interpolated into an XML attribute without escaping. A value containing " followed by additional XML can break out of the attribute and inject extra elements. Proof of Concept source.title injection: enclosure.type injection: Both injections were confirmed with fast-xml-parser: the injected "link": "https://evil.com" appears in the…

    Recommended action: Upgrade to 4.0.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →