CVE-2023-26491CWE-79

RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters

Medium · published March 3, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version, there are no known workarounds.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00434 · 36.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-03-03T22:41Z
EPSS history
Timeline
  • 03 MAR 22:41Z
    RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters
    cvelistv5