GHSA-PGJJ-866W-FC5C Risk of code injection

🗓️ 12 Oct 2021 16:03:43Reported by GoogleType

osv🔗 osv.dev👁 18 Views

Risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues.Patches include temporarily removed the problematic route and added a `no-new-func` rule to eslint. Self-built users should upgrade to 7f1c430 and later as soon as possible. Credits to Tencent Woodpecker Security Team

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2021-21278	26 Jan 202121:15	–	attackerkb
Circl	CVE-2021-21278	27 Jan 202100:36	–	circl
CNNVD	RSSHub Injection Vulnerability	26 Jan 202100:00	–	cnnvd
CVE	CVE-2021-21278	26 Jan 202120:25	–	cve
Cvelist	CVE-2021-21278 Risk of code injection in RSSHub	26 Jan 202120:25	–	cvelist
EUVD	EUVD-2021-2237	7 Oct 202500:30	–	euvd
Github Security Blog	Risk of code injection	12 Oct 202116:03	–	github
NVD	CVE-2021-21278	26 Jan 202121:15	–	nvd
Prion	Code injection	26 Jan 202121:15	–	prion
RedhatCVE	CVE-2021-21278	22 May 202519:09	–	redhatcve

Source	Link
github	www.github.com/DIYgod/RSSHub/security/advisories/GHSA-pgjj-866w-fc5c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21278
github	www.github.com/DIYgod/RSSHub/commit/7f1c43094e8a82e4d8f036ff7d42568fed00699d
github	www.github.com/DIYgod/RSSHub
npmjs	www.npmjs.com/package/rsshub

13 Mar 2026 22:01Current

9.4High risk

Vulners AI Score9.4

CVSS 3.18.6

EPSS0.01572