CVE-2024-29896: Content-Security-Policy Header Injection in @kindspells/astro-shield
Summary
CVE-2024-29896: Content-Security-Policy header generation in middleware could be compromised by malicious injections. Affects @kindspells/astro-shield versions >= 1.2.0, < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @kindspells/astro-shield package is an npm package that provides middleware for generating Content-Security-Policy (CSP) headers in server-side rendered (SSR) content. It is commonly used in web applications to enhance security by specifying which resources can be loaded by the browser. However, a vulnerability has been discovered in versions prior to 1.3.0 that could compromise the CSP headers generation process when serving content that can be partially controlled by external users.
Vulnerability Detail
The vulnerability arises when the automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users. In such cases, the CSP headers generation feature might inadvertently allow-list malicious injected resources, such as inlined JavaScript or references to external malicious scripts. This can lead to the execution of unauthorized code and potential security breaches.
How To Fix
Latest published version: 1.7.1 as of 23 Oct 2026
npm install @kindspells/astro-shield@1.7.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.0
This is the first release that contains the fix.
npm install @kindspells/astro-shield@1.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to disable the CSP headers generation feature. Alternatively, the feature should only be used for dynamically generated content that cannot be controlled by external users in any way. These workarounds help mitigate the risk of allowing malicious injected resources.
Conclusion
The @kindspells/astro-shield package prior to version 1.3.0 is vulnerable to a Content-Security-Policy header injection issue. This vulnerability can allow for the inclusion of malicious resources in the CSP headers generation process, potentially leading to unauthorized code execution. It is recommended to update the package to version 1.3.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @kindspells/astro-shield →
FAQ
The vulnerability allows for the potential injection of malicious resources into the CSP headers generation process, which can lead to the execution of unauthorized code and security breaches.
Versions prior to 1.3.0 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes the package-lock.json file to identify vulnerabilities in your software.
At the time of this report, there are no known exploits for this vulnerability. However, it is crucial to update to the patched version to prevent potential exploitation.
For more information, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-w387-5qqw-7g8m/GHSA-w387-5qqw-7g8m.json
References
Related vulnerabilities
Recent vulnerabilities recorded for @kindspells/astro-shield.
