The vulnerability arises in the @astrojs/rss component of the Astro web framework, where source.title and enclosure.type are inserted directly into XML template strings without escaping. The fields are only validated as generic strings, which permits an attacker to inject arbitrary XML. This can break attributes or prematurely close elements, enabling the attacker to inject false metadata, such as malicious links, or to manipulate feed readers into displaying attacker‑controlled content. In server‑side rendering mode, the corrupted feed is served to all subscribers on every request, potentially exposing many users to the injected content.

The flaw affects the Astro framework and its RSS component @astrojs/rss. It exists in Astro releases from 1.0.0 through 4.0.18. Any project that relies on this package without updating beyond version 4.0.19 is vulnerable.

The CVSS score of 4.3 indicates low to moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to control the values of source.title or enclosure.type, which are typically derived from user‑supplied content or a content management system. If the attacker can supply these values, they can corrupt the RSS feed structure, insert malicious links or content, and cause feed readers to misparse or display attacker‑controlled data. In server‑side rendering mode, the poisoned feed would be delivered to all subscribers on each request until the library is updated.