CVE-2026-59728

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59728", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-06T15:34:16.917Z", "datePublished": "2026-07-27T19:54:23.009Z", "dateUpdated": "2026-07-28T14:27:56.334Z"}, "containers": {"cna": {"title": "@astrojs/rss: XML Injection via Unescaped RSS Feed Fields", "problemTypes": [{"descriptions": [{"cweId": "CWE-91", "lang": "en", "description": "CWE-91: XML Injection (aka Blind XPath Injection)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q"}, {"name": "https://github.com/withastro/astro/pull/17209", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/pull/17209"}, {"name": "https://github.com/withastro/astro/commit/fbcfa039dfe3d700b239f595a6c55ee35e45bd06", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/commit/fbcfa039dfe3d700b239f595a6c55ee35e45bd06"}, {"name": "https://github.com/withastro/astro/releases/tag/@astrojs/rss@4.0.19", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/releases/tag/@astrojs/rss@4.0.19"}], "affected": [{"vendor": "withastro", "product": "astro", "versions": [{"version": ">= 1.0.0, < 4.0.19", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-27T19:54:23.009Z"}, "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing \" can break out of an attribute (as with enclosure.type), and a value containing </source> can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake <link> pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19."}], "source": {"advisory": "GHSA-8j5q-mfj2-5q9q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T14:27:36.621244Z", "id": "CVE-2026-59728", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T14:27:56.334Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59728", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T14:27:36.621244Z"}}}], "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T14:27:52.024Z"}}], "cna": {"title": "@astrojs/rss: XML Injection via Unescaped RSS Feed Fields", "source": {"advisory": "GHSA-8j5q-mfj2-5q9q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "withastro", "product": "astro", "versions": [{"status": "affected", "version": ">= 1.0.0, < 4.0.19"}]}], "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q", "name": "https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/withastro/astro/pull/17209", "name": "https://github.com/withastro/astro/pull/17209", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/withastro/astro/commit/fbcfa039dfe3d700b239f595a6c55ee35e45bd06", "name": "https://github.com/withastro/astro/commit/fbcfa039dfe3d700b239f595a6c55ee35e45bd06", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/withastro/astro/releases/tag/@astrojs/rss@4.0.19", "name": "https://github.com/withastro/astro/releases/tag/@astrojs/rss@4.0.19", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing \" can break out of an attribute (as with enclosure.type), and a value containing </source> can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake <link> pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-91", "description": "CWE-91: XML Injection (aka Blind XPath Injection)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-27T19:54:23.009Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59728", "state": "PUBLISHED", "dateUpdated": "2026-07-28T14:27:56.334Z", "dateReserved": "2026-07-06T15:34:16.917Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-27T19:54:23.009Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "astro", "vendor": "withastro", "versions": [{"status": "affected", "version": ">= 1.0.0, < 4.0.19"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing \" can break out of an attribute (as with enclosure.type), and a value containing </source> can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake <link> pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19."}, {"lang": "es", "value": "Astro es un framework web para sitios web basados en contenido. En las versiones 1.0.0 a 4.0.18, los campos de elemento source.title y enclosure.type en packages/astro-rss/src/index.ts se interpolan directamente en cadenas de plantilla XML sin escape de caracteres XML antes de ser analizados por fast-xml-parser. Ambos campos se validan solo como z.string(), sin imponer ninguna restricci\u00f3n sobre los caracteres especiales XML. Un atacante que controla estos valores puede inyectar XML arbitrario en el feed RSS generado: un valor que contenga \u2019\u201d\u2019 puede salir de un atributo (como con enclosure.type), y un valor que contenga [/source] puede cerrar un elemento prematuramente e inyectar nodos adicionales (como con source.title). Esto corrompe la estructura del feed, inyecta metadatos falsos (por ejemplo, un [link] falso que apunta a una URL maliciosa), y puede hacer que los lectores de feeds analicen incorrectamente o muestren contenido controlado por el atacante. En modo SSR (output: \u2019server\u2019), el feed envenenado se sirve en cada solicitud a todos los suscriptores. Este problema ha sido solucionado en la versi\u00f3n 4.0.19."}], "id": "CVE-2026-59728", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59728", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T14:27:36.621244Z", "version": "2.0.3"}}]}, "published": "2026-07-27T21:17:05.700", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/commit/fbcfa039dfe3d700b239f595a6c55ee35e45bd06"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/pull/17209"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/releases/tag/@astrojs/rss@4.0.19"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-91"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,4.0.19)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "astro", "source": "cna", "vendor": "withastro"}, "product": "astro", "vendor": "withastro"}], "created": "2026-07-28T03:15:07.797551+00:00", "updated": "2026-08-03T17:00:06.125031+00:00", "vendors": ["withastro", "withastro$PRODUCT$astro"]}