Code injection

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278 Risk of code injection in RSSHub

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278

RSSHub is affected by a code-injection vulnerability in which certain routes use eval or the Function constructor, allowing unsafe code to be injected by a target site. The root cause is unsafe dynamic code evaluation in specific routes. The fix (version 7f1c430) temporarily removes the problemat...

CVE-2021-21278

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

RSSHub Injection Vulnerability

An injection vulnerability exists in RSSHub that stems from the use of "eval" or "Function constructor" in some routes, leading to server-side security issues...

PT-2021-14384

Name of the Vulnerable Software and Affected Versions: RSSHub versions prior to 7f1c430 Description: RSSHub is an open source, easy to use, and extensible RSS feed generator. The issue arises from some routes using eval or Function constructor, which may be injected by the target site with unsafe...

CVE-2021-21278: Improper Neutralization of Special Elements in Output Used by a Downstream Component

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...