@chocolatey-software/astro (>=2.0.0, <=2.8.0), @kunyan/astro-blog (>=0.1.3, <=0.1.4) +19 more potentially affected by CVE-2026-59728 via @astrojs/rss (>=2.4.0, <=4.0.18)

@astrojs/rss NPM version =2.4.0, =2.0.0, =0.1.3, =0.0.1, =0.1.0, =0.0.9, =0.1.0, =0.2.0, =0.0.1, =1.0.29, =0.1.0, =0.2.0 and more Source cves: CVE-2026-59728 Source advisory: MEND:CVE-2026-59728...

@chocolatey-software/astro (>=2.0.0, <=2.8.0), @kunyan/astro-blog (>=0.1.3, <=0.1.4) +19 more potentially affected by CVE-2026-59728 via @astrojs/rss (>=2.4.0, <=4.0.18)

@astrojs/rss NPM version =2.4.0, =2.0.0, =0.1.3, =0.0.1, =0.1.0, =0.0.9, =0.1.0, =0.2.0, =0.0.1, =1.0.29, =0.1.0, =0.2.0 and more Source cves: CVE-2026-59728 Source advisory: OSV:GHSA-8J5Q-MFJ2-5Q9Q...

@chocolatey-software/astro (>=2.0.0, <=2.8.0), @kunyan/astro-blog (>=0.1.3, <=0.1.4) +19 more potentially affected by CVE-2026-59728 via @astrojs/rss (>=2.4.0, <=4.0.18)

@astrojs/rss NPM version =2.4.0, =2.0.0, =0.1.3, =0.0.1, =0.1.0, =0.0.9, =0.1.0, =0.2.0, =0.0.1, =1.0.29, =0.1.0, =0.2.0 and more Source cves: CVE-2026-59728 Source advisory: SNYK:JS-ASTROJSRSS-18085631...

@chocolatey-software/astro (>=2.0.0, <=2.8.0), @kunyan/astro-blog (>=0.1.3, <=0.1.4) +19 more potentially affected by CVE-2026-59728 via @astrojs/rss (>=2.4.0, <=4.0.18)

@astrojs/rss NPM version =2.4.0, =2.0.0, =0.1.3, =0.0.1, =0.1.0, =0.0.9, =0.1.0, =0.2.0, =0.0.1, =1.0.29, =0.1.0, =0.2.0 and more Source cves: CVE-2026-59728 Source advisory: GHSA-8J5Q-MFJ2-5Q9Q...

XML Injection

Overview @astrojs/rss is an Add RSS feeds to your Astro projects Affected versions of this package are vulnerable to XML Injection via the source.title and enclosure.type fields, which are interpolated directly into XML templates without proper escaping. An attacker can inject arbitrary XML...