GitHub Advisoryadvisory · npm

GHSA-w387-5qqw-7g8m Content-Security-Policy header generation in middleware could be compromised by malicious injections

HIGH Published 2024-03-29 Modified 2024-09-12 Official page ↗
Aliases
CVE-2024-29896
Ecosystem
npm
Packages
@kindspells/astro-shield
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-74
Reviewed
2024-03-29

Affected packages

• npm @kindspells/astro-shield: >= 1.2.0, < 1.3.0 → fixed in 1.3.0

Description

Impact When the following conditions are met: • Automated CSP headers generation for SSR content is enabled • The web application serves content that can be partially controlled by external users Then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. Patches Available in version 1.3.0 . Workarounds • Do not enable CSP headers generation. • Use it only for dynamically generated content that cannot be controlled by external users in any way. References _Are there any links users can visit to find out more?_

Related

Alias · CVE (1)

  • CVE-2024-29896 Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References