PT-2021-14384 · Rsshub · Rsshub

Published 2021-01-26 · Updated 2021-10-12 · CVE-2021-21278

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: RSSHub versions prior to 7f1c430

Description: RSSHub is an open source, easy to use, and extensible RSS feed generator. The issue arises from some routes using eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side security issues.

Recommendations: For versions prior to 7f1c430, upgrade to version 7f1c430 or later as soon as possible. As a temporary workaround, consider disabling the routes that use eval or Function constructor until the issue is resolved. Additionally, applying the no-new-func rule to eslint can help mitigate the risk.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-21278

GHSA-PGJJ-866W-FC5C

Affected Products

Rsshub

References · 9

• https://github.com/DIYgod/RSSHub/commit/7f1c43094e8a82e4d8f036ff7d42568fed00699d · Patch
• https://osv.dev/vulnerability/GHSA-pgjj-866w-fc5c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21278 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21278 · Vendor Advisory
• https://github.com/DIYgod/RSSHub/security/advisories/GHSA-pgjj-866w-fc5c · Note
• https://github.com/DIYgod/RSSHub · Note
• https://npmjs.com/package/rsshub · Note
• https://t.me/cibsecurity/22684 · Telegram Post
• https://t.me/cvenotify/8989 · Telegram Post