CVE-2024-29896 json
Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections
published 2y ago modified 2mo ago also GHSA-w387-5qqw-7g8m , EUVD-2024-1019
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.
Patch / fix
- npm @kindspells/astro-shield 1.3.0
- KindSpells astro-shield 1.3.0
Is CVE-2024-29896 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @kindspells/astro-shield | >=1.2.0, <1.3.0 |
1.3.0 |
Affected products
- KindSpells astro-shield
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
-
github.com
/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d
web, patch
-
github.com
/KindSpells/astro-shield/commit/ad3abf5577bae9be420b7ddf376337a5b8817869
web
-
github.com
/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8m
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-29896
advisory
-
github.com
/KindSpells/astro-shield
package
-
github.com
/KindSpells/astro-shield/compare/1.2.0...1.3.0
web
Sources
- CVE List CVE-2024-29896
- GitHub Advisory GHSA-w387-5qqw-7g8m
- NVD CVE-2024-29896
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.