CVE-2023-26491: rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters
Summary
CVE-2023-26491: rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters. Affects rsshub versions < 1.0.0-master.c910c4d. Fixed in 1.0.0-master.c910c4d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rsshub is an npm package that provides a lightweight and customizable RSS hub for various content sources. It allows users to aggregate and consume RSS feeds from different websites in a centralized manner. However, a vulnerability has been discovered in rsshub that allows for Cross-site Scripting (XSS) attacks when certain special characters are present in the URL parameters. This vulnerability can lead to the execution of arbitrary JavaScript code, potentially compromising the security and integrity of user data.
Vulnerability Detail
The vulnerability in rsshub arises from the improper handling of XSS vulnerabilities in error pages. When the URL parameters contain specific special characters, the application returns an error page that does not properly sanitize or validate the input. As a result, an attacker can craft a malicious URL that includes JavaScript code, which will be executed when accessed by a user. This can lead to various consequences, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user.
How To Fix
Latest published version: 1.0.0-master.a630023 as of 23 Oct 2026
npm install rsshub@1.0.0-master.a630023Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0-master.c910c4d
This is the first release that contains the fix.
npm install rsshub@1.0.0-master.c910c4dTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the provided fix by upgrading to the patched version of rsshub.
Conclusion
rsshub is vulnerable to Cross-site Scripting (XSS) attacks due to improper handling of URL parameters. Upgrading to version 1.0.0-master.c910c4d or a later release of rsshub is necessary to fix this vulnerability. It is recommended to promptly apply the fix to ensure the security and integrity of user data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rsshub →
FAQ
rsshub is an npm package that acts as an RSS hub, allowing users to aggregate and consume RSS feeds from various sources in a centralized manner.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code, theft of sensitive information, or unauthorized actions on behalf of the user.
Users who access a specially crafted URL containing the vulnerable rsshub instance can be affected by this vulnerability. The execution of arbitrary JavaScript code can lead to various security risks, including data theft and unauthorized actions.
Yes, this vulnerability has been fixed in version 1.0.0-master.c910c4d or a later release of rsshub. It is recommended to upgrade to the patched version to mitigate the risk of XSS attacks.
No, there are no known workarounds for this vulnerability. It is crucial to apply the provided fix by upgrading to the patched version of rsshub.
References
Related vulnerabilities
Recent vulnerabilities recorded for rsshub.
