Skip to content
OpenAdvisories

Package · npm

@astrojs/rss

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.3
    CVE-2026-59728

    @astrojs/rss: XML Injection via Unescaped RSS Feed Fields

    Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping befor…

    withastro astro @astrojs/rss npm