{"cve":"CVE-2024-30250","nvd":{"published":"2024-04-04T15:15:39.240","modified":"2026-06-17T07:26:36.217","status":"Analyzed","description":"Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-345"],"references":["https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a","https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f","https://github.com/kindspells/astro-shield/releases/tag/1.3.2","https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc","https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a"],"products":["kindspells:astro-shield"],"source":"nvd","synced_at":"2026-10-19T21:48:32.179249784+00:00"},"epss":{"cve":"CVE-2024-30250","score":0.0031,"percentile":0.23841,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-c4gr-q97g-ppwc","url":"https://osv.dev/vulnerability/GHSA-c4gr-q97g-ppwc","summary":"In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists","modified":"2026-09-10T03:50:11.207762646Z","packages":[{"ecosystem":"npm","name":"@kindspells/astro-shield","purl":"pkg:npm/%40kindspells/astro-shield","ranges":[">=1.2.0 <1.3.2"],"fixed":["1.3.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}