{"id":"CVE-2024-29896","aliases":["EUVD-2024-1019","GHSA-w387-5qqw-7g8m"],"status":"published","title":"Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections","description":"Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be \"allow-listing\" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00591,"percentile":0.48755,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2024-03-28T12:48:53Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"npm","package":"@kindspells/astro-shield","fixed_in":["1.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@kindspells/astro-shield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"last_affected":"1.2.0"},{"fixed":"1.3.0"}]}],"versions":["1.2.0"]},{"source":"osv","ecosystem":"npm","package":"@kindspells/astro-shield","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.3.0"}]}],"versions":["1.2.0"]}],"products":[{"vendor":"kindspells","product":"astro-shield"}],"references":[{"url":"https://github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8m","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29896","tags":["advisory"]},{"url":"https://github.com/KindSpells/astro-shield/commit/ad3abf5577bae9be420b7ddf376337a5b8817869","tags":["web"]},{"url":"https://github.com/KindSpells/astro-shield/compare/1.2.0...1.3.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w387-5qqw-7g8m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29896.json","tags":["advisory"]},{"url":"https://github.com/KindSpells/astro-shield","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-29896","title":"Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections","description":"Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be \"allow-listing\" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.","status":"published","published":"2024-03-28T12:48:53.104Z","modified":"2024-08-02T01:17:58.611Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:14.985673Z"}],"euvd":[{"id":"EUVD-2024-1019","description":"Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be \"allow-listing\" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.","status":"published","published":"2024-03-28T12:48:53Z","modified":"2024-08-02T01:17:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:50:25.628684Z"}],"ghsa":[{"id":"GHSA-w387-5qqw-7g8m","title":"Content-Security-Policy header generation in middleware could be compromised by malicious injections","description":"### Impact\n\nWhen the following conditions are met:\n- Automated CSP headers generation for SSR content is enabled\n- The web application serves content that can be partially controlled by external users\n\nThen it is possible that the CSP headers generation feature might be \"allow-listing\" malicious injected resources like inlined JS, or references to external malicious scripts.\n\n### Patches\nAvailable in version 1.3.0 .\n\n### Workarounds\n- Do not enable CSP headers generation.\n- Use it only for dynamically generated content that cannot be controlled by external users in any way.\n\n### References\n_Are there any links users can visit to find out more?_\n","status":"published","published":"2024-03-29T19:03:59Z","modified":"2024-09-12T13:52:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:38:02.014847Z"}],"nvd":[{"id":"CVE-2024-29896","description":"Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be \"allow-listing\" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.","status":"published","published":"2024-03-28T13:15:47.717Z","modified":"2026-06-17T07:23:19.533Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:09:44.124823Z"}],"osv":[{"id":"CVE-2024-29896","title":"Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections","description":"Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be \"allow-listing\" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.","status":"published","published":"2024-03-28T12:48:53.104Z","modified":"2026-10-28T02:30:36.629335707Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"GHSA-w387-5qqw-7g8m","title":"Content-Security-Policy header generation in middleware could be compromised by malicious injections","description":"### Impact\n\nWhen the following conditions are met:\n- Automated CSP headers generation for SSR content is enabled\n- The web application serves content that can be partially controlled by external users\n\nThen it is possible that the CSP headers generation feature might be \"allow-listing\" malicious injected resources like inlined JS, or references to external malicious scripts.\n\n### Patches\nAvailable in version 1.3.0 .\n\n### Workarounds\n- Do not enable CSP headers generation.\n- Use it only for dynamically generated content that cannot be controlled by external users in any way.\n\n### References\n_Are there any links users can visit to find out more?_\n","status":"published","published":"2024-03-29T19:03:59Z","modified":"2026-09-10T03:50:10.744431344Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:58.04805Z"}]}}