RSSHub 资源管理错误漏洞

RSSHub is an RSS feed generator written in Node.js, distributed under the MIT license and maintained by DIYgod and other GitHub users. A resource management error vulnerability exists in versions of RSSHub prior to 2020-02-09, which stems from the fact that parameters such as filter and filterout...

Denial Of Service (DoS)

rsshub is vulnerable to denial of service attacks. A malicious user is able to cause abnormally high CPU usages in the system via passing specifically crafted values through filter and filterout parameters, resulting in denial of service conditions...

Denial of Service (DoS) vulnerability in RSSHub

Impact Passing some special values to the filter and filterout parameters can cause an abnormally high CPU. Impact on the performance of the servers and RSSHub services. Patches It is fixed in 5c4177441417b44a6e45c3c63e9eac2504abeb5b , please update to this or the later versions as soon as...

GHSA-JVXX-V45P-V5VF Denial of Service (DoS) vulnerability in RSSHub

Impact Passing some special values to the filter and filterout parameters can cause an abnormally high CPU. Impact on the performance of the servers and RSSHub services. Patches It is fixed in 5c4177441417b44a6e45c3c63e9eac2504abeb5b , please update to this or the later versions as soon as...

PT-2022-20535 · Rsshub · Rsshub

Name of the Vulnerable Software and Affected Versions: RSSHub versions prior to 5c4177441417 Description: The issue arises when special values are passed to the filter and filterout parameters, causing abnormally high CPU usage. This impacts the performance of servers and RSSHub services,...

Remote Code Execution (RCE)

rsshub is vulnerable to remote code execution. An attacker is able to inject malicious code via the eval or Function constructor which allows an attacker to inject and execute codes in the system...

CVE-2021-21278

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

Code injection

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278 Risk of code injection in RSSHub

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278

RSSHub is affected by a code-injection vulnerability in which certain routes use eval or the Function constructor, allowing unsafe code to be injected by a target site. The root cause is unsafe dynamic code evaluation in specific routes. The fix (version 7f1c430) temporarily removes the problemat...

RSSHub Injection Vulnerability

An injection vulnerability exists in RSSHub that stems from the use of "eval" or "Function constructor" in some routes, leading to server-side security issues...