CVE-2026-59728: 
JavaScript vulnerability analysis and mitigation

CVE-2026-59728 is an XML Injection vulnerability in the @astrojs/rss npm package, affecting all versions from 1.0.0 up to (but not including) 4.0.19. The flaw allows an attacker who controls RSS feed item field values (source.title and enclosure.type) to inject arbitrary XML elements into the generated RSS feed output. It was discovered and privately reported by researcher alanturing881, with the fix merged on June 26, 2026, and the advisory published on July 15, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Moderate) (GitHub Advisory, Astro Security Advisory).

The root cause is CWE-91 (XML Injection): two fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings and then parsed by fast-xml-parser without any XML-character escaping. For source.title, the value is embedded as element content — a payload containing </source> followed by arbitrary XML breaks out of the element and injects additional nodes. For enclosure.type, the value is embedded in an XML attribute — a payload containing a double-quote (") followed by XML markup can break out of the attribute context and inject extra elements. Both fields are validated only as z.string() with no restriction on XML special characters, meaning no additional attacker privileges or complex conditions are required beyond the ability to supply these field values (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to inject arbitrary XML elements into the generated RSS feed, enabling feed poisoning attacks such as inserting malicious links (e.g., pointing to attacker-controlled URLs) or causing feed readers to misparse or display attacker-controlled content. There is no direct confidentiality or availability impact; the primary risk is integrity loss to the RSS feed output. In SSR mode (output: 'server'), the poisoned feed is dynamically served on every request, meaning all feed subscribers receive the tampered content until the issue is remediated (Astro Security Advisory).

1. Identify target: Locate an Astro-based website using @astrojs/rss versions >= 1.0.0 and < 4.0.19 that incorporates user-controlled or externally-sourced data into RSS feed item source.title or enclosure.type fields.
2. Craft malicious source.title payload: Supply a value such as Real Title</source><link>https://evil.com</link><source url="https://legit.example.com"> as the source.title field. When interpolated into the XML template string and parsed, this closes the <source> element prematurely and injects additional XML nodes.
3. Craft malicious enclosure.type payload: Alternatively, supply a value such as audio/mpeg" /><link>https://evil.example.com</link><enclosure url="https://example.com/a.mp3" length="0" type="audio/mpeg as the enclosure.type field to break out of the XML attribute and inject elements.
4. Trigger feed generation: Cause the application to generate the RSS feed (e.g., by requesting the RSS endpoint), which will include the injected XML in the output.
5. Impact subscribers: Feed readers that consume the poisoned RSS feed will parse and potentially render the injected elements, displaying attacker-controlled links or content to all subscribers. In SSR mode, every subsequent request serves the poisoned feed (Astro Security Advisory, GitHub Advisory).

• RSS Feed Content: Unexpected or duplicate XML elements (e.g., extra <link>, <source>, or <enclosure> tags) within RSS feed <item> entries, particularly those referencing external or suspicious URLs.
• Logs: Application or web server logs showing requests to the RSS feed endpoint from unusual sources, or abnormal feed generation errors related to XML parsing in fast-xml-parser.
• Feed Output: RSS feed items where source.title or enclosure.type values contain XML special characters (<, >, ") when viewed in raw feed source, indicating unsanitized input reaching the feed generator (Astro Security Advisory).

Upgrade @astrojs/rss to version 4.0.19 or later, which resolves the vulnerability by serializing source and enclosure fields as structured XML objects rather than interpolating values into raw XML strings, ensuring special characters are always treated as text (Release Notes, Fix Commit). No official configuration-based workaround is provided; as an interim measure, operators should sanitize or validate source.title and enclosure.type field values to reject XML special characters before passing them to the RSS generation function.

The vulnerability was discovered internally by Astro contributor matthewp (who also authored the fix) and reported by researcher alanturing881. The fix was reviewed and approved by Astro maintainer delucis with a straightforward LGTM, and the patch was merged without a linked issue, indicating it was proactively identified rather than reported through a formal bug report. No significant broader media coverage or social media discussion has been observed (Astro PR #17209).