npm package
rsshub
pkg:npm/rsshub
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-27927 | — | < 1.0.0-master.a429472 | 1.0.0-master.a429472 | Mar 6, 2024 | RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attac | ||
| CVE-2024-27926 | — | >= 1.0.0-master.cbbd829, < 1.0.0-master.d8ca915 | 1.0.0-master.d8ca915 | Mar 6, 2024 | RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the e | ||
| CVE-2023-26491 | — | < 1.0.0-master.c910c4d | 1.0.0-master.c910c4d | Mar 3, 2023 | RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the delibe | ||
| CVE-2023-22493 | — | < 1.0.0-master.a66cbcf | 1.0.0-master.a66cbcf | Jan 13, 2023 | RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulner | ||
| CVE-2022-31110 | — | <= 1.0.0 | — | Jun 29, 2022 | RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and RSSHub services which | ||
| CVE-2021-21278 | — | <= 1.0.0 | — | Jan 26, 2021 | RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, cau |
- CVE-2024-27927Mar 6, 2024affected < 1.0.0-master.a429472fixed 1.0.0-master.a429472
RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attac
- CVE-2024-27926Mar 6, 2024affected >= 1.0.0-master.cbbd829, < 1.0.0-master.d8ca915fixed 1.0.0-master.d8ca915
RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the e
- CVE-2023-26491Mar 3, 2023affected < 1.0.0-master.c910c4dfixed 1.0.0-master.c910c4d
RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the delibe
- CVE-2023-22493Jan 13, 2023affected < 1.0.0-master.a66cbcffixed 1.0.0-master.a66cbcf
RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulner
- CVE-2022-31110Jun 29, 2022affected <= 1.0.0
RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and RSSHub services which
- CVE-2021-21278Jan 26, 2021affected <= 1.0.0
RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, cau