What’s Vulnerable › Vulnerabilities

CVE-2023-26491: RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-03 · updated 2026-06-17
• Weakness: CWE-79

Description

RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version, there are no known workarounds.

Affected products

• DIYgod RSSHub: before 2023-03-02 — fixed in 2023-03-02

How to fix

Upgrade to a fixed version: DIYgod RSSHub 2023-03-02. Check the vendor advisory for mitigations.

References

• https://github.com/DIYgod/RSSHub/commit/c910c4d28717fb860fbe064736641f379fab2c91
• https://github.com/DIYgod/RSSHub/security/advisories/GHSA-32gr-4cq6-5w5q
• https://github.com/DIYgod/RSSHub/commit/c910c4d28717fb860fbe064736641f379fab2c91
• https://github.com/DIYgod/RSSHub/security/advisories/GHSA-32gr-4cq6-5w5q

Get alerted when CVE-2023-26491 or the next vulnerability affects your stack