CVE-2026-59728: Astro @astrojs/rss XML injection in source and enclosure fields

CVE-2026-59728 · Severity: medium · CVSS 4.3 · Published 2026-07-27

Astro is a web framework used for building content-driven websites. A vulnerability in its RSS feed generation package allows attackers to inject malicious content into a site's RSS feed. This could be used to redirect users to malicious websites or display fake information to subscribers, potentially damaging a site's reputation or leading to phishing attacks.

Vendors: Astro, npm.

Quick answers

Is CVE-2026-59728 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59728 being exploited in the wild.
How severe is CVE-2026-59728?
Medium severity, with a CVSS score of 4.3, published 27 July 2026.
Which products and versions are affected?
Astro Rss >= 1.0.0, < 4.0.19; @astrojs/rss (npm) >= 1.0.0, < 4.0.19, SEMVER:introduced=1.0.0,fixed=4.0.19.
Is there a fix for CVE-2026-59728?
Yes. @astrojs/rss (npm): upgrade to 4.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59728 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59728?
Check whether you run Astro Rss or @astrojs/rss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @astrojs/rss (npm): upgrade to 4.0.19 or later
    npm install @astrojs/rss@4.0.19

Technical details

An XML injection vulnerability exists in the @astrojs/rss package due to improper neutralization of XML special characters. The 'source.title' and 'enclosure.type' fields are interpolated directly into XML template strings without escaping before being processed by fast-xml-parser. An attacker who can control these values (e.g., via a CMS or user-submitted content) can break out of XML attributes or elements to inject arbitrary nodes, such as malicious <link> tags. This is particularly impactful in Server-Side Rendering (SSR) mode, where the poisoned feed is served to all subscribers. The issue is fixed in version 4.0.19 by switching to structured XML object serialization.

Affected products

  • Astro @astrojs/rss >= 1.0.0, < 4.0.19

Identifiers

  • CVE-2026-59728
  • GHSA-8j5q-mfj2-5q9q

Timeline

  • 2026-06-26: patched: Fix merged into main branch
  • 2026-06-30: patched: Version 4.0.19 released
  • 2026-07-15: advisory: GitHub Security Advisory published
  • 2026-07-27: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.