https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 03:13:28 +0000 https://cve.radiocsirt.org/vuln/certfr-2024-avi-1103 certfr-2024-avi-1103 https://cve.radiocsirt.org/vuln/certfr-2024-avi-1103 https://cve.radiocsirt.org/vuln/euvd-2026-4697 EUVD-2026-4697 https://cve.radiocsirt.org/vuln/euvd-2026-4697 https://cve.radiocsirt.org/vuln/fkie_cve-2024-29896 <p>Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be &#34;allow-listing&#34; malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.</p> <p>Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be &#34;allow-listing&#34; malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-29896 https://cve.radiocsirt.org/vuln/ghsa-w387-5qqw-7g8m <p><strong>Affected:</strong> npm: @kindspells/astro-shield</p> <p>### Impact</p> <p>When the following conditions are met: - Automated CSP headers generation for SSR content is enabled - The web application serves content that can be partially controlled by external users</p> <p>Then it is possible that the CSP headers generation feature might be &#34;allow-listing&#34; malicious injected resources like inlined JS, or references to external malicious scripts.</p> <p>### Patches Available in version 1.3.0 .</p> <p>### Workarounds - Do not enable CSP headers generation. - Use it only for dynamically generated content that cannot be controlled by external users in any way.</p> <p>### References _Are there any links users can visit to find out more?_</p> <p><strong>Affected:</strong> npm: @kindspells/astro-shield</p> <p>### Impact</p> <p>When the following conditions are met: - Automated CSP headers generation for SSR content is enabled - The web application serves content that can be partially controlled by external users</p> <p>Then it is possible that the CSP headers generation feature might be &#34;allow-listing&#34; malicious injected resources like inlined JS, or references to external malicious scripts.</p> <p>### Patches Available in version 1.3.0 .</p> <p>### Workarounds - Do not enable CSP headers generation. - Use it only for dynamically generated content that cannot be controlled by external users in any way.</p> <p>### References _Are there any links users can visit to find out more?_</p> https://cve.radiocsirt.org/vuln/ghsa-w387-5qqw-7g8m https://cve.radiocsirt.org/vuln/gsd-2024-29896 gsd-2024-29896 https://cve.radiocsirt.org/vuln/gsd-2024-29896