rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters

GHSA-32gr-4cq6-5w5q · CVE-2023-26491

Published Mar 1, 2023 · Modified Sep 10, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code.

Users who access the deliberately constructed URL are affected.

Patches

This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version.

Workarounds

No.

References

WEB https://github.com/DIYgod/RSSHub/security/advisories/GHSA-32gr-4cq6-5w5q
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-26491
WEB https://github.com/DIYgod/RSSHub/commit/c910c4d28717fb860fbe064736641f379fab2c91
PACKAGE https://github.com/DIYgod/RSSHub

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes