rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters
Impact
When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code.
Users who access the deliberately constructed URL are affected.
Patches
This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version.
Workarounds
No.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | rsshub | < 1.0.0-master.c910c4d | 1.0.0-master.c910c4d |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
rsshub- Disclosed
- 01.03.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-32gr-4cq6-5w5q - CC BY 4.0
Vulnerability history: rsshub
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 10.2021 03.2024
- Without a fix
- 2
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 4
Disclosures per year
- 2021: 1
- 2022: 1
- 2023: 2
- 2024: 2
- 2025: 0
- 2026: 0
-
rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.