XML Injection Vulnerability in Astro Web Framework by Astro

CVE-2026-59728

What is CVE-2026-59728?

The Astro web framework has a vulnerability in its handling of XML template strings within RSS feed generation. Due to improper XML character escaping for certain fields, an attacker could inject malicious XML content into the generated feeds. This flaw allows for potentially corrupting the feed structure, injecting false metadata, and redirecting users to harmful locations. The issue specifically arises when values for source.title and enclosure.type are processed without adequate validation, permitting attackers to manipulate the output in both SSR mode and client requests. Affected users should upgrade to version 4.0.19 to ensure that the issue is resolved.

References