cve.bz

CVE-2024-27926

6.1 mediumEPSS 0.5%

Medium (6.1) in rsshub rsshub. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in rsshub 1.0.0-master.d8ca915.

RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version 1.0.0-master.d8ca915. No known workarounds are available.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2wqw-hr4f-xrhhnpmrsshub>=1.0.0-master.cbbd829 <1.0.0-master.d8ca9151.0.0-master.d8ca915

References

Check your stackJSON