Most recent entries from all

certfr-2024-avi-1103 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

2026-10-13T03:13:53.403996+00:00

certfr-2024-avi-1103

EUVD-2026-4697

2026-10-13T03:13:53.404034+00:00

EUVD-2026-4697

fkie_cve-2024-29896

2026-10-13T03:13:53.404049+00:00

Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.

GHSA-w387-5qqw-7g8m — Content-Security-Policy header generation in middleware could be compromised by malicious injections

2026-10-13T03:13:53.404096+00:00

Affected: npm: @kindspells/astro-shield

### Impact

When the following conditions are met: - Automated CSP headers generation for SSR content is enabled - The web application serves content that can be partially controlled by external users

Then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts.

### Patches Available in version 1.3.0 .

### Workarounds - Do not enable CSP headers generation. - Use it only for dynamically generated content that cannot be controlled by external users in any way.

### References _Are there any links users can visit to find out more?_

gsd-2024-29896

2026-10-13T03:13:53.404137+00:00

gsd-2024-29896