PT-2023-20681 · Rsshub · Rsshub

Ry0Tak · Published 2023-03-01 · Updated 2023-03-13 · CVE-2023-26491

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions RSSHub versions prior to c910c4d28717fb860fbe064736641f379fab2c91

Description RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected.

Recommendations For versions prior to c910c4d28717fb860fbe064736641f379fab2c91, please upgrade to version c910c4d28717fb860fbe064736641f379fab2c91 or a later version to resolve the issue. As a temporary workaround, consider restricting access to URLs with special characters in the parameters to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-26491

GHSA-32GR-4CQ6-5W5Q

Affected Products

Rsshub

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26491.json · Exploit
• https://github.com/DIYgod/RSSHub/commit/c910c4d28717fb860fbe064736641f379fab2c91 · Patch
• https://github.com/DIYgod/RSSHub/security/advisories/GHSA-32gr-4cq6-5w5q · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-32gr-4cq6-5w5q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26491 · Security Note
• https://github.com/DIYgod/RSSHub · Note
• https://t.me/cibsecurity/59422 · Telegram Post