{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "1.0.0"
              },
              {
                "fixed": "4.0.19"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "a4f24266c0ca262df7c4e040a6fbb3559747b43a"
            },
            {
              "fixed": "5978993531ba3f02a4c639d223f810e80a1fa7d3"
            }
          ],
          "repo": "https://github.com/withastro/astro",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-8j5q-mfj2-5q9q"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-91"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59728.json"
  },
  "details": "Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing \" can break out of an attribute (as with enclosure.type), and a value containing \u003c/source\u003e can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake \u003clink\u003e pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19.",
  "id": "CVE-2026-59728",
  "modified": "2026-07-30T03:52:47.319713191Z",
  "published": "2026-07-27T19:54:23.009Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/releases/tag/@astrojs/rss@4.0.19"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59728.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59728"
    },
    {
      "type": "FIX",
      "url": "https://github.com/withastro/astro/commit/fbcfa039dfe3d700b239f595a6c55ee35e45bd06"
    },
    {
      "type": "FIX",
      "url": "https://github.com/withastro/astro/pull/17209"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@astrojs/rss: XML Injection via Unescaped RSS Feed Fields"
}