CVE-2024-27926 MEDIUM

CVE-2024-27926: RSSHub Cross-site Scripting vulnerability caused by internal media proxy

Vendor Diygod
Product RSSHub
Weakness CWE-79 · XSS
Published March 6, 2024
Last update August 5, 2024
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version 1.0.0-master.d8ca915. No known workarounds are available.

Key dates

02Disclosure timeline

March 6, 2024 CVE published
August 5, 2024 Record updated