VulertSecurity VulertSecurity

Vulnerability Database · npm · Package report

rsshub: vulnerability history, versions and safety

rsshub is a package in the npm ecosystem. Vulert records 6 vulnerabilities for it across 120 releases, from Oct 2021 to Mar 2024. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
6 vulnerabilities recorded H2 M4
i
2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all rsshub vulnerabilities

Vulert verdict on rsshub 1.0.0-master.a630023 i

Updated on 23 Oct 2026

Careful: 1.0.0-master.a630023 has 2 known vulnerabilities, and 2 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release 1.0.0-master.a630023 — affected i
  • Vulnerabilities on record 6 over 2 years · 0 in the last year i
  • Latest disclosure 06 Mar 2024 i
  • Highest CVSS 8.8 i
  • With no published fix 2 i
  • Stars 46,602 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence AGPL-3.0 i

Version list, release dates, licence and dependants published by the npm registry, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for rsshub, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
1.0.0-master.a630023 23 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.6f4f814 23 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.1fb7a17 22 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.7aaf947 22 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.0b037cf 22 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.cb89eea 22 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.ff8340a 22 Oct 2026 H2 M2 AGPL-3.0 No Details →
1.0.0-master.11e57a3 22 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.70e402b 22 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.9dae780 22 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.8a9141e 22 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.b976dbd 22 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.ec765d3 22 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.6a75df8 21 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.1facb67 21 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.bde3790 21 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.f2ef406 21 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.b480266 21 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.51f74b2 20 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.095cbe5 20 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.1c7e106 20 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.5b399b2 19 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.f5dd404 19 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.4fbf0d3 19 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.09c896b 19 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.a251fb5 18 Oct 2026 H1 M2 AGPL-3.0 No Details →
1.0.0-master.eb7d2c7 18 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.0f4b929 18 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.5d47d3a 17 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.e50d306 16 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.53aa1fd 16 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.13395e1 16 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.29aa183 16 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.c0ebbc9 16 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.0f184a3 16 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.8e94b94 16 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.8aeca4c 16 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.f23ada8 15 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.b4a7c36 15 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.d24f513 15 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.8e8a176 15 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.0bcea1c 14 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.8f7d429 14 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.959493 14 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.d7a84ed 14 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.ca88590 14 Oct 2026 H2 M2 AGPL-3.0 No Details →
1.0.0-master.66411e5 14 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.68a1109 14 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.a9140b8 14 Oct 2026 H1 M2 AGPL-3.0 No Details →
1.0.0-master.a7faf80 14 Oct 2026 H2 M2 AGPL-3.0 No Details →
1.0.0-master.3a4942f 13 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.d837e95 13 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.3b7c376 13 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.fce10ac 13 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.6a9e8cb 13 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.c717e45 12 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.1470116 12 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.d55daa0 12 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.4b1f220 12 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.a7d4000 11 Oct 2026 H2 M2 AGPL-3.0 No Details →
1.0.0-master.c3dfdf4 10 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.fdd8612 10 Oct 2026 H2 M2 AGPL-3.0 No Details →
1.0.0-master.5d857e3 10 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.8613fc2 09 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.0b0a0c3 09 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.7cb59d9 09 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.66454b7 09 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.5117089 09 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.f04b215 09 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.1f5bc61 09 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.4d4e71a 09 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.d4ffe00 07 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.21ea7a8 07 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.d91baf2 06 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.78895f0 06 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.87f78ed 06 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.a794017 06 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.4abb7a6 05 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.c4e168a 05 Oct 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.0f80e1b 04 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.ad611a1 04 Oct 2026 H1 M2 AGPL-3.0 No Details →
1.0.0-master.9f0553d 03 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.089df27 02 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.058a494 02 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.3bc1cc2 02 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.5d7e6ce 01 Oct 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.fc008f7 30 Sep 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.29ab762 30 Sep 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.39ace33 29 Sep 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.f07c7bc 29 Sep 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.36f3b71 29 Sep 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.3cafae5 29 Sep 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.75dc866 28 Sep 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.a9a900b 28 Sep 2026 H2 M2 AGPL-3.0 No Details →
1.0.0-master.f2e7337 27 Sep 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.c33b727 27 Sep 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.ead57e5 27 Sep 2026 H2 M3 AGPL-3.0 No Details →
1.0.0-master.2f236f8 27 Sep 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.771e705 27 Sep 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.17b9b9f 27 Sep 2026 H1 M1 AGPL-3.0 No Details →
1.0.0-master.1c35615 27 Sep 2026 H1 M1 — No Details →
1.0.0-master.9e15f62 27 Sep 2026 H1 M1 — No Details →
1.0.0-master.c83c7ac 27 Sep 2026 H2 M3 — No Details →
1.0.0-master.9d4afe3 27 Sep 2026 H1 M1 — No Details →
1.0.0-master.90b4bfa 26 Sep 2026 H1 M1 — No Details →
1.0.0-master.a35b376 26 Sep 2026 H2 M2 — No Details →
1.0.0-master.4b25ea7 26 Sep 2026 H1 M1 — No Details →
1.0.0-master.799c30c 26 Sep 2026 H1 M1 — No Details →
1.0.0-master.df160b7 26 Sep 2026 H2 M3 — No Details →
1.0.0-master.f04db3d 26 Sep 2026 H2 M3 — No Details →
1.0.0-master.dc8e815 26 Sep 2026 H2 M3 — No Details →
1.0.0-master.c500798 26 Sep 2026 H2 M2 — No Details →
1.0.0-master.a442c97 26 Sep 2026 H1 M2 — No Details →
1.0.0-master.d89d20f 26 Sep 2026 H2 M3 — No Details →
1.0.0-master.f07c879 26 Sep 2026 H2 M3 — No Details →
1.0.0-master.62c0707 26 Sep 2026 H1 M1 — No Details →
1.0.0-master.a5ef48a 26 Sep 2026 H2 M2 — No Details →
1.0.0-master.980db92 26 Sep 2026 H1 M1 — No Details →
1.0.0-master.0b0490f 26 Sep 2026 H1 M1 — No Details →
1.0.0-master.5929a46 25 Sep 2026 H1 M1 — No Details →

The newest 120 of 6,346 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 1
  • 2022 1
  • 2023 2
  • 2024 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 6 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for rsshub

The 5 most severe of 6 vulnerabilities recorded for this package

Search all 6 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2023-22493: SSRF vulnerability in RSSHub 8.8 high 1.0.0-master.a66cbcf 11 Jan 2023
CVE-2021-21278: Code Injection Vulnerability in rsshub 8.6 high No fix published 12 Oct 2021
RSSHub Vulnerable to Server-Side Request Forgery (SSRF) 6.5 medium 1.0.0-master.a429472 06 Mar 2024
CVE-2023-26491: rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters 6.1 medium 1.0.0-master.c910c4d 01 Mar 2023
CVE-2024-27926: RSSHub Cross-site Scripting Vulnerability 6.1 medium 1.0.0-master.d8ca915 06 Mar 2024

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About rsshub

Is rsshub safe to use?

Vulert records 6 vulnerabilities for rsshub in npm: 0 critical, 2 high, 4 medium and 0 low. 2 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is rsshub's Vulert package health score?

Vulert scores rsshub 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of rsshub affected?

Yes. 1.0.0-master.a630023, the version you would install today, has 2 known vulnerabilities, and 2 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does rsshub have?

6 vulnerabilities are recorded for rsshub in the npm ecosystem: 0 critical, 2 high, 4 medium and 0 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new rsshub vulnerabilities disclosed?

0 vulnerabilities were recorded for rsshub in the last 12 months, and the oldest entry in this database dates to 12 Oct 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of rsshub are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor rsshub for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the rsshub version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.