Skip to content

Product

@astrojs/rss vulnerabilities

1 published CVE affecting @astrojs/rss, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest @astrojs/rss CVEs

Newest publication first

  1. CVE-2026-59728 @astrojs/rss: XML Injection via Unescaped RSS Feed Fields

    Published
    MediumCVSS 4.3 EPSS 0.32%

    Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fas...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.