High severity7.5NVD Advisory· Published Mar 28, 2024· Updated Jun 17, 2026
CVE-2024-29896
CVE-2024-29896
Description
Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@kindspells/astro-shieldnpm | >= 1.2.0, < 1.3.0 | 1.3.0 |
Affected products
3- cpe:2.3:a:kindspells:astro-shield:1.2.0:*:*:*:*:*:*:*
- KindSpells/astro-shieldv5Range: = 1.2.0
Patches
Vulnerability mechanics
References
6- github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566dnvdPatchWEB
- github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8mnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-w387-5qqw-7g8mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-29896ghsaADVISORY
- github.com/KindSpells/astro-shield/commit/ad3abf5577bae9be420b7ddf376337a5b8817869ghsaWEB
- github.com/KindSpells/astro-shield/compare/1.2.0...1.3.0ghsaWEB
News mentions
0No linked articles in our index yet.