CVE-2023-26491 MEDIUM

CVE-2023-26491: RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters

Vendor Diygod
Product RSSHub
Weakness CWE-79 · XSS
Published March 3, 2023
Last update February 25, 2025
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

What the vulnerability does

01Description

RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version, there are no known workarounds.

Key dates

02Disclosure timeline

March 3, 2023 CVE published
February 25, 2025 Record updated