CVE-2021-21278 Risk of code injection in RSSHub
Attackers can execute arbitrary code on the server by injecting malicious scripts into RSSHub routes that use eval or Function constructors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21278?
CVE-2021-21278 is a high-severity code injection vulnerability in DIYgod RSSHub, published on 26 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint.
Weakness: CWE-74
Which versions are affected by CVE-2021-21278?
2 open source packages ship an affected version, including rsshub. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rsshub npm | All versions to 1.0.0 | None |
rsshub npm | All versions to 1.0.0 | None |
Products include Rsshub Rsshub.
How do I fix CVE-2021-21278?
No fix has been published for CVE-2021-21278 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-21278 being exploited?
There is no known exploitation of CVE-2021-21278 in the wild and no public exploit code.
Other vulnerabilities in DIYgod RSSHub
- CVE-2023-22493 RSSHub is vulnerable to SSRF (Server-Side Request Forgery)
- CVE-2024-27927 RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4
- CVE-2024-27926 RSSHub Cross-site Scripting vulnerability caused by internal media proxy
- CVE-2023-26491 RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters
- CVE-2022-31110 Denial of Service (DoS) vulnerability in RSSHub
Sources
Also known as GHSA-pgjj-866w-fc5c.