1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
astrojs-rss
Ecosystem: npm
Downloads: 3.88 Mln
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting astrojs-rss, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-8j5q-mfj2-5q9q | Moderate | @astrojs/rss: XML Injection via Unescaped RSS Feed Fields## Summary In `@astrojs/rss`, the `source.title` and `enclosure.type` item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by `fast-xml-parser`. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS feed. ## Details Two fields in `packages/astro-rss/src/index.ts` are affected: ### `source.title` ```typescript item.source = parser.parse( `<source url="${result.source.url}">${result.source.title}</source>`, ).source; ``` `source.title` is validated only as `z.string()`, with no re |
| GitHub (opens in a new tab) |
- GHSA-8j5q-mfj2-5q9qModerate@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
>= 1.0.0, < 4.0.19
## Summary In `@astrojs/rss`, the `source.title` and `enclosure.type` item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by `fast-xml-parser`. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS feed. ## Details Two fields in `packages/astro-rss/src/index.ts` are affected: ### `source.title` ```typescript item.source = parser.parse( `<source url="${result.source.url}">${result.source.title}</source>`, ).source; ``` `source.title` is validated only as `z.string()`, with no re
CVE: CVE-2026-59728