CVE-2026-59728

Deferred Deferred - Pending Action

XML Injection in Astro Framework RSS Feed

Publication date: 2026-07-27

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing " can break out of an attribute (as with enclosure.type), and a value containing </source> can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake <link> pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-28

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-59728

EUVD

EUVD-2026-49584

Affected Vendors & Products

Vendor	Product	Version / Range
astro	astro	From 1.0.0 (inc) to 4.0.18 (inc)
astro	astro	4.0.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-91	The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Astro web framework versions 1.0.0 through 4.0.18. It allows XML injection in RSS feeds due to improper escaping of the source.title and enclosure.type fields. Attackers can inject malicious XML content, corrupting feed structure and misleading feed readers.

Detection Guidance

To detect this vulnerability, inspect Astro applications using versions 1.0.0 through 4.0.18 for RSS feed generation. Check if source.title or enclosure.type fields in RSS templates contain XML special characters like <, >, or &. Review generated RSS feeds for malformed XML or unexpected content injection.

Impact Analysis

An attacker could manipulate RSS feeds to include false metadata like fake links to malicious websites. This could trick users into visiting harmful sites or mislead them with incorrect information. In SSR mode, all subscribers receive the poisoned feed on every request.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling XML injection in RSS feeds. Attackers could manipulate feed content to include malicious links or false metadata, potentially leading to phishing attacks or unauthorized data exposure. However, the CVE does not explicitly detail compliance implications.

Mitigation Strategies

Upgrade Astro to version 4.0.19 or later immediately. If upgrading is not possible, disable RSS feed generation in affected applications or sanitize source.title and enclosure.type inputs to remove XML special characters before rendering.

Hi! I’m here to help you understand CVE-2026-59728. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70