GitHub Advisoryadvisory · npm

GHSA-32gr-4cq6-5w5q rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters

MEDIUM Published 2023-03-01 Modified 2023-03-13 Official page ↗
Aliases
CVE-2023-26491
Ecosystem
npm
Packages
rsshub
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-03-01

Affected packages

• npm rsshub: < 1.0.0-master.c910c4d → fixed in 1.0.0-master.c910c4d

Description

Impact When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. Patches This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version. Workarounds No.

Related

Alias · CVE (1)

  • CVE-2023-26491 RSSHub is an open source and extensible RSS feed generator. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References