What’s Vulnerable › Vulnerabilities

CVE-2024-30250: In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-04 · updated 2026-06-17
• Weakness: CWE-345

Description

Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2.

Affected products

• KindSpells astro-shield: from 1.2.0 before 1.3.2 — fixed in 1.3.2

How to fix

Upgrade to a fixed version: KindSpells astro-shield 1.3.2. Check the vendor advisory for mitigations.

References

• https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a
• https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f
• https://github.com/kindspells/astro-shield/releases/tag/1.3.2
• https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc
• https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a
• https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f
• https://github.com/kindspells/astro-shield/releases/tag/1.3.2
• https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc

Get alerted when CVE-2024-30250 or the next vulnerability affects your stack