[NPM:GHSA-W387-5QQW-7G8M] Content-Security-Policy header generation in middleware could be compromised by malicious injections
Severity
High
Affected Packages
1
Fixed Packages
1
CVEs
1
Impact
When the following conditions are met:
- Automated CSP headers generation for SSR content is enabled
- The web application serves content that can be partially controlled by external users
Then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts.
Patches
Available in version 1.3.0 .
Workarounds
- Do not enable CSP headers generation.
- Use it only for dynamically generated content that cannot be controlled by external users in any way.
References
Are there any links users can visit to find out more?
| Package | Affected Version |
|---|---|
 pkg:npm/%40kindspells/astro-shield
|
= 1.2.0 |
| Package | Fixed Version |
|---|---|
|
pkg:npm/%40kindspells/astro-shield
|
= 1.3.0 |
- ID
- NPM:GHSA-W387-5QQW-7G8M
- Severity
- high
- URL
- https://github.com/advisories/GHSA-w387-5qqw-7g8m
- Published
-
2024-03-29T19:03:59
(5 months ago) - Modified
-
2024-03-29T19:04:00
(5 months ago) - Rights
- NPM Security Team
| Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
|---|---|---|---|---|---|---|---|
| Affected | pkg:npm/%40kindspells/astro-shield | @kindspells |
astro-shield
|
= 1.2.0 | |||
| Fixed | pkg:npm/%40kindspells/astro-shield | @kindspells |
astro-shield
|
= 1.3.0 |
| # CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
|---|---|---|---|---|---|---|---|---|---|---|---|
| # CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |