{"id":"CVE-2024-29896","aliases":["GHSA-w387-5qqw-7g8m"],"url":"https://o3.security/vulnerability/CVE-2024-29896","summary":"Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections","details":"### Impact\n\nWhen the following conditions are met:\n- Automated CSP headers generation for SSR content is enabled\n- The web application serves content that can be partially controlled by external users\n\nThen it is possible that the CSP headers generation feature might be \"allow-listing\" malicious injected resources like inlined JS, or references to external malicious scripts.\n\n### Patches\nAvailable in version 1.3.0 .\n\n### Workarounds\n- Do not enable CSP headers generation.\n- Use it only for dynamically generated content that cannot be controlled by external users in any way.\n\n### References\n_Are there any links users can visit to find out more?_\n","published":"2024-03-28T12:48:53.104Z","modified":"2026-08-12T03:51:09.720887347Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@kindspells/astro-shield","fixedVersion":"1.3.0"}],"fix":{"url":"https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d","label":"KindSpells/astro-shield@41b8457"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29896.json"},{"type":"ADVISORY","url":"https://github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29896"},{"type":"FIX","url":"https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d"},{"type":"WEB","url":"https://github.com/KindSpells/astro-shield/commit/ad3abf5577bae9be420b7ddf376337a5b8817869"},{"type":"PACKAGE","url":"https://github.com/KindSpells/astro-shield"},{"type":"WEB","url":"https://github.com/KindSpells/astro-shield/compare/1.2.0...1.3.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:09.720887347Z"}}