CVE-2021-21278: Code Injection Vulnerability in rsshub
Summary
CVE-2021-21278: Risk of code injection. Affects rsshub versions < 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rsshub is an npm package that provides a lightweight and customizable RSS feed aggregator. It allows users to fetch and combine various RSS feeds into a single feed. The package is widely used for aggregating and delivering RSS content. However, it is vulnerable to a code injection attack.
Vulnerability Detail
The vulnerability (CVE-2021-21278) in rsshub arises from the usage of eval or Function constructor in certain routes. These routes can be exploited by an attacker to inject malicious code into the server-side execution context. This can lead to severe security issues, as the injected code can perform unauthorized actions, access sensitive data, or compromise the server's integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can follow the recommended fix by upgrading to the latest version of rsshub.
Conclusion
The code injection vulnerability (CVE-2021-21278) in rsshub can be exploited by attackers to inject malicious code into the server-side execution context. This can lead to severe security issues, including unauthorized actions, data breaches, and compromise of the server's integrity. To mitigate this vulnerability, users should upgrade to version 7f1c430 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for rsshub →
FAQ
The vulnerability allows an attacker to inject malicious code into the server-side execution context of rsshub. This can lead to unauthorized actions, data breaches, and compromise of the server's integrity.
The vulnerability was discovered by the Tencent Woodpecker Security Team.
No, versions prior to 1.0.0 are not affected by this vulnerability. However, it is recommended to upgrade to the latest version to ensure the security of your application.
You can open an issue on the rsshub GitHub repository at https://github.com/DIYgod/RSSHub/issues. Alternatively, you can email the rsshub maintainers at i@diygod.me.
Yes, the CVSS score for this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for rsshub.
