Homepage

@kindspells/astro-shield@1.2.0 vulnerabilities

Astro integration to enhance your website's security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques.

  • latest version

    1.7.1

  • latest non vulnerable version

    1.7.1

  • first published

    1 years ago

  • latest version published

    8 months ago

  • licenses detected

  • View astro-shield package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @kindspells/astro-shield package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Insufficient Verification of Data Authenticity

    @kindspells/astro-shield is an Astro integration to enhance your website's security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques.

    Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to the setting of a correct integrity attribute to injected code. This allows bypassing the allow-lists for cross-origin resources by introducing valid integrity attributes to the injected code, leading the browser to believe that the injected resource is legitimate.

    Note: To exploit this issue, an attacker must first inject code into the rendered pages by exploiting other not-related potential vulnerabilities.

    How to fix Insufficient Verification of Data Authenticity?

    Upgrade @kindspells/astro-shield to version 1.3.2 or higher.

    >=1.2.0 <1.3.2
    • H
    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    @kindspells/astro-shield is an Astro integration to enhance your website's security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques.

    Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') when automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users. An attacker can allow-list malicious injected resources like inlined JS, or references to external malicious scripts by exploiting the CSP headers generation feature.

    How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')?

    Upgrade @kindspells/astro-shield to version 1.3.0 or higher.

    >=1.2.0 <1.3.0
    Go back to all versions of this package