CVE-2026-59728: @astrojs/rss: XML Injection via Unescaped RSS Feed Fields
In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS feed.
References
- github.com/advisories/GHSA-8j5q-mfj2-5q9q
- github.com/withastro/astro/commit/fbcfa039dfe3d700b239f595a6c55ee35e45bd06
- github.com/withastro/astro/pull/17209
- github.com/withastro/astro/releases/tag/@astrojs/rss@4.0.19
- github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q
- nvd.nist.gov/vuln/detail/CVE-2026-59728
Code Behaviors & Features
Detect and mitigate CVE-2026-59728 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →