Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe security vulnerability is a classic XML injection issue within the @astrojs/rss package. The root cause was located in the generateRSS function in packages/astro-rss/src/index.ts. The analysis of the provided patch commit fbcfa039dfe3d700b239f595a6c55ee35e45bd06 clearly shows the vulnerable code and the corresponding fix.
Previously, the code used string concatenation to build XML snippets for <source> and <enclosure> tags. The values for source.title and enclosure.type were directly embedded into these strings and then parsed using an XML parser. This is unsafe because special XML characters in the input were not escaped, allowing an attacker to break out of the intended XML structure and inject their own elements.
The patch rectifies this by changing the approach. Instead of building a raw XML string, it now creates a structured JavaScript object. This object is then passed to the XML builder, which handles the necessary escaping of special characters, thus preventing the injection. The vulnerable code was explicitly removed and replaced, making generateRSS the function where the vulnerability existed and was fixed.
generateRSSpackages/astro-rss/src/index.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @astrojs/rss | npm | >= 1.0.0, < 4.0.19 | 4.0.19 |