chore(deps): update dependency @astrojs/rss to v4.0.19 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/rss (source)	4.0.18 → 4.0.19

---

@​astrojs/rss: XML Injection via Unescaped RSS Feed Fields

CVE-2026-59728 / GHSA-8j5q-mfj2-5q9q

More information

Details

Summary

In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS feed.

Details

Two fields in packages/astro-rss/src/index.ts are affected:

source.title

item.source = parser.parse(
  `<source url="${result.source.url}">${result.source.title}</source>`,
).source;

source.title is validated only as z.string(), with no restriction on XML special characters. A value containing </source> followed by arbitrary XML is parsed as real XML elements, merging injected nodes into the RSS item.

enclosure.type

item.enclosure = parser.parse(
  `<enclosure url="${enclosureURL}" length="${result.enclosure.length}" type="${result.enclosure.type}"/>`,
).enclosure;

enclosure.type is also z.string() and is interpolated into an XML attribute without escaping. A value containing " followed by additional XML can break out of the attribute and inject extra elements.

Proof of Concept

source.title injection:

source: {
  url: 'https://legit.example.com',
  title: '</source><item><title>INJECTED</title><link>https://evil.com</link></item><source>',
}
// Result: RSS feed contains an injected <item> element with an evil.com link

enclosure.type injection:

enclosure: {
  url: 'https://example.com/a.mp3',
  length: 0,
  type: 'audio/mpeg" /><link>https://evil.example.com</link><enclosure fake="',
}
// Result: RSS feed contains an injected <link> element

Both injections were confirmed with fast-xml-parser: the injected "link": "https://evil.com" appears in the parsed output.

Impact

An attacker who can control source.title or enclosure.type values (e.g., via a CMS, database, or user-submitted content that populates RSSFeedItem) can inject arbitrary XML into the generated RSS feed. This corrupts feed structure, injects false metadata (e.g., a fake <link> pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers.

Patches

Fixed in @astrojs/rss@4.0.19.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

• https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q
• https://github.com/withastro/astro/pull/17209
• https://github.com/withastro/astro/commit/fbcfa039dfe3d700b239f595a6c55ee35e45bd06
• https://github.com/withastro/astro/releases/tag/@​astrojs/rss@4.0.19
• https://github.com/advisories/GHSA-8j5q-mfj2-5q9q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

withastro/astro (@​astrojs/rss)

v4.0.19

Compare Source

Patch Changes

• #​17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🎊 PR Preview 65a6281 has been successfully built and deployed to https://catppuccin-website-build-pr-351.surge.sh

🕐 Build time: 0.015s

_{🤖 By surge-preview}