CVE-2026-59728: Astro Web Framework XXE Vulnerability

CVE-2026-59728 Overview

CVE-2026-59728 is an XML injection vulnerability [CWE-91] in the @astrojs/rss package used by Astro, a web framework for content-driven websites. Versions 1.0.0 through 4.0.18 interpolate the source.title and enclosure.type fields directly into XML template strings without escaping XML special characters. An attacker who controls these values can inject arbitrary XML nodes into generated RSS feeds. In server-side rendering (SSR) mode, the poisoned feed reaches every subscriber on every request. The issue is fixed in version 4.0.19.

Critical Impact
Attackers can corrupt RSS feed structure, inject false metadata such as fake <link> elements pointing to malicious URLs, and cause feed readers to display attacker-controlled content to all subscribers.

Affected Products

Astro @astrojs/rss package versions 1.0.0 through 4.0.18
Astro projects using RSS feed generation in SSR mode (output: 'server')
Astro projects using RSS feed generation in static output mode

Discovery Timeline

2026-07-27 - CVE-2026-59728 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-59728

Vulnerability Analysis

The vulnerability resides in packages/astro-rss/src/index.ts, where user-supplied RSS item fields are concatenated into XML template literals before being handed to fast-xml-parser. Both source.title and enclosure.type are validated only as z.string() through Zod, which permits any character including <, >, ", and &. Because the parser processes the raw interpolated string, any XML metacharacter in these fields is interpreted as markup rather than data.

A " character in enclosure.type terminates the type attribute and allows injection of additional attributes on the <enclosure> element. A </source> sequence in source.title closes the element early and permits injection of sibling XML nodes such as a forged <link>. Feed readers subsequently render the attacker's content as legitimate feed data.

Root Cause

The root cause is missing XML-character escaping (mapped to [CWE-91] XML Injection) before string interpolation into an XML document. The Zod schema validates type but not content, and no sanitization layer sits between input and the parser.

Attack Vector

Exploitation requires an attacker to control the value of source.title or enclosure.type supplied to the RSS generator, typically through content sources such as a CMS, database entries, or user-generated content pipelines. When the feed is rendered, injected nodes become part of the served XML. In SSR mode, every consumer of the endpoint receives the poisoned feed.

typescript

// Security patch in packages/astro-rss/src/index.ts
// Escape source and enclosure fields in RSS feed generation (#17209)

				: createCanonicalURL(result.commentsUrl, rssOptions.trailingSlash, site);
		}
		if (result.source) {
-			item.source = parser.parse(
-				`<source url="${result.source.url}">${result.source.title}</source>`,
-			).source;
+			item.source = {
+				'#text': result.source.title,
+				'@_url': result.source.url,
+			};
		}
		if (result.enclosure) {
			const enclosureURL = isValidURL(result.enclosure.url)
				? result.enclosure.url
				: createCanonicalURL(result.enclosure.url, rssOptions.trailingSlash, site);
-			item.enclosure = parser.parse(
-				`<enclosure url="${enclosureURL}" length="${result.enclosure.length}" type="${result.enclosure.type}"/>`,
-			).enclosure;
+			item.enclosure = {
+				'@_url': enclosureURL,
+				'@_length': result.enclosure.length,
+				'@_type': result.enclosure.type,
+			};
		}
		return item;
	});

Source: GitHub Commit fbcfa03. The patch removes string-based XML construction and instead passes structured objects to fast-xml-parser, which handles attribute and text-node escaping safely.

Detection Methods for CVE-2026-59728

Indicators of Compromise

RSS feed output containing unexpected <link>, <source>, or <enclosure> elements not present in application content models.
source.title or enclosure.type values in content sources containing <, >, ", or closing tags such as </source>.
Feed reader telemetry showing outbound clicks to domains not owned by the publisher.

Detection Strategies

Inventory Astro projects and check the installed @astrojs/rss version against the fixed release 4.0.19.
Diff generated RSS feed output against expected XML schemas to identify injected nodes or attributes.
Scan content databases for XML metacharacters in fields that feed into source.title or enclosure.type.

Monitoring Recommendations

Log and review changes to RSS content sources, particularly fields sourced from third-party contributors.
Monitor web server access logs for automated scraping of /rss.xml or equivalent endpoints in SSR deployments.
Add integrity checks that validate RSS output against a strict XSD or expected element list before serving.

How to Mitigate CVE-2026-59728

Immediate Actions Required

Upgrade @astrojs/rss to version 4.0.19 or later across all Astro projects.
Audit RSS content sources for existing entries with XML metacharacters in source.title and enclosure.type fields.
For SSR deployments, invalidate any cached feed responses after upgrading to remove poisoned content.

Patch Information

The fix is available in @astrojs/rss 4.0.19. See the GitHub Security Advisory GHSA-8j5q-mfj2-5q9q and the pull request discussion #17209 for full remediation context. The patch replaces string interpolation with structured object input to fast-xml-parser, ensuring safe attribute and text-node encoding.

Workarounds

If upgrading is not immediately possible, sanitize source.title and enclosure.type before passing them to the RSS generator by stripping or entity-encoding <, >, ", ', and &.
Tighten the input schema by replacing z.string() with a Zod refinement that rejects XML special characters.
Restrict which authors or content pipelines can populate RSS metadata fields until the upgrade is deployed.

bash

# Upgrade @astrojs/rss to the patched version
npm install @astrojs/rss@4.0.19

# Verify the installed version
npm ls @astrojs/rss

# Rebuild the Astro project after upgrade
npm run build