CVE-2024-29896

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Mar 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-298974.9CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) o CVE-2024-298986.5CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-2989 CVE-2024-29908.8A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. This affects the function formexeCommand of the file /CVE-2024-299007.5Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready CVE-2024-299018.1The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can r CVE-2024-299025.9Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachmen CVE-2024-299037.5Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts ca CVE-2024-299047.5CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability c CVE-2024-299055.5DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process CVE-2024-299065.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Tax CVE-2024-299077.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Active Websight SEO Backlink Monitor a CVE-2024-299086.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kienso Co-marquage service-public.Fr a