{"cve":"CVE-2024-29896","nvd":{"published":"2024-03-28T13:15:47.717","modified":"2026-06-17T07:23:19.533","status":"Analyzed","description":"Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be \"allow-listing\" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-74"],"references":["https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d","https://github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8m","https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d","https://github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8m"],"products":["kindspells:astro-shield"],"source":"nvd","synced_at":"2026-10-19T21:47:51.568503435+00:00"},"epss":{"cve":"CVE-2024-29896","score":0.00591,"percentile":0.48272,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-w387-5qqw-7g8m","url":"https://osv.dev/vulnerability/GHSA-w387-5qqw-7g8m","summary":"Content-Security-Policy header generation in middleware could be compromised by malicious injections","modified":"2026-09-10T03:50:10.744431344Z","packages":[{"ecosystem":"npm","name":"@kindspells/astro-shield","purl":"pkg:npm/%40kindspells/astro-shield","ranges":[">=1.2.0 <1.3.0"],"fixed":["1.3.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}