CVE-2021-21278
Summary
| CVE | CVE-2021-21278 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-01-26 21:15:00 UTC |
| Updated | 2021-02-04 16:25:00 UTC |
| Description | RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint. |
Risk And Classification
Problem Types: CWE-74
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| feat: remove some routes for security reasons, !!! no-eval no-new-fun… · DIYgod/RSSHub@7f1c430 · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Risk of code injection · Advisory · DIYgod/RSSHub · GitHub | CONFIRM | github.com | Third Party Advisory |
| rsshub - npm | MISC | www.npmjs.com | Product, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 980452 Nodejs (npm) Security Update for rsshub (GHSA-pgjj-866w-fc5c)