Описание
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
Summary
In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS feed.
Details
Two fields in packages/astro-rss/src/index.ts are affected:
source.title
source.title is validated only as z.string(), with no restriction on XML special characters. A value containing </source> followed by arbitrary XML is parsed as real XML elements, merging injected nodes into the RSS item.
enclosure.type
enclosure.type is also z.string() and is interpolated into an XML attribute without escaping. A value containing " followed by additional XML can break out of the attribute and inject extra elements.
Proof of Concept
source.title injection:
enclosure.type injection:
Both injections were confirmed with fast-xml-parser: the injected "link": "https://evil.com" appears in the parsed output.
Impact
An attacker who can control source.title or enclosure.type values (e.g., via a CMS, database, or user-submitted content that populates RSSFeedItem) can inject arbitrary XML into the generated RSS feed. This corrupts feed structure, injects false metadata (e.g., a fake <link> pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers.
Patches
Fixed in @astrojs/rss@4.0.19.
Ссылки
- https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q
- https://nvd.nist.gov/vuln/detail/CVE-2026-59728
- https://github.com/withastro/astro/pull/17209
- https://github.com/withastro/astro/commit/fbcfa039dfe3d700b239f595a6c55ee35e45bd06
- https://github.com/withastro/astro/releases/tag/@astrojs/rss@4.0.19
Пакеты
@astrojs/rss
>= 1.0.0, < 4.0.19
4.0.19
Связанные уязвимости
Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing " can break out of an attribute (as with enclosure.type), and a value containing </source> can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake <link> pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.1