Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0yd3F3LWhyNGYteHJoaM4AA5zN
RSSHub Cross-site Scripting vulnerability caused by internal media proxy
Impact
When the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code.
Users who access the deliberately constructed URL are affected.
Patches
This vulnerability was fixed in version https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87. Please upgrade to this or a later version.
Workarounds
No.
Permalink: https://github.com/advisories/GHSA-2wqw-hr4f-xrhhJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yd3F3LWhyNGYteHJoaM4AA5zN
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 months ago
Updated: about 1 month ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-2wqw-hr4f-xrhh, CVE-2024-27926
References:
- https://github.com/DIYgod/RSSHub/security/advisories/GHSA-2wqw-hr4f-xrhh
- https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87
- https://nvd.nist.gov/vuln/detail/CVE-2024-27926
- https://github.com/advisories/GHSA-2wqw-hr4f-xrhh
Blast Radius: 7.3
Affected Packages
npm:rsshub
Dependent packages: 8Dependent repositories: 16
Downloads: 24,089 last month
Affected Version Ranges: >= 1.0.0-master.cbbd829, < 1.0.0-master.d8ca915
Fixed in: 1.0.0-master.d8ca915
All affected versions: 1.0.0-master.cbbd829, 1.0.0-master.cbca59f, 1.0.0-master.cbd46f6, 1.0.0-master.cbd832d, 1.0.0-master.cbe111a, 1.0.0-master.cbea1f9, 1.0.0-master.cbf016b, 1.0.0-master.cc1f892, 1.0.0-master.cc04d9a, 1.0.0-master.cc7ea6a, 1.0.0-master.cc7ef5e, 1.0.0-master.cc8c869, 1.0.0-master.cc11b96, 1.0.0-master.cc33fec, 1.0.0-master.cc34dfb, 1.0.0-master.cc48b48, 1.0.0-master.cc562aa, 1.0.0-master.cc738ea, 1.0.0-master.cc6241a, 1.0.0-master.cc27156, 1.0.0-master.ccad5e8, 1.0.0-master.ccbe399, 1.0.0-master.ccc7f43, 1.0.0-master.ccd6b3a, 1.0.0-master.cce38cf, 1.0.0-master.cd0b88f, 1.0.0-master.cd5c87f, 1.0.0-master.cd6b5e0, 1.0.0-master.cd6f2d9, 1.0.0-master.cd44ac2, 1.0.0-master.cd151f4, 1.0.0-master.cd81467, 1.0.0-master.cd91931, 1.0.0-master.cdad597, 1.0.0-master.cdb6f6f, 1.0.0-master.cdb74c2, 1.0.0-master.cdb583b, 1.0.0-master.cdc36d3, 1.0.0-master.cdcb2e5, 1.0.0-master.cdd1d2f, 1.0.0-master.cdd1170, 1.0.0-master.cde7722, 1.0.0-master.ce1d349, 1.0.0-master.ce1e743, 1.0.0-master.ce8d3d3, 1.0.0-master.ce15d05, 1.0.0-master.ce511b5, 1.0.0-master.ce19844, 1.0.0-master.ce97430, 1.0.0-master.ceaff4c, 1.0.0-master.cebf7e2, 1.0.0-master.cefd957, 1.0.0-master.cf1c302, 1.0.0-master.cf1fe23, 1.0.0-master.cf04b7e, 1.0.0-master.cf6dff4, 1.0.0-master.cf79fa8, 1.0.0-master.cf97ab4, 1.0.0-master.cf674e2, 1.0.0-master.cf80541, 1.0.0-master.cfd2477, 1.0.0-master.cfd5224, 1.0.0-master.cfe185e, 1.0.0-master.cfe8569, 1.0.0-master.cfef518, 1.0.0-master.cff988a, 1.0.0-master.cffdd8f, 1.0.0-master.d0beccb, 1.0.0-master.d0d3b6b, 1.0.0-master.d00de3b, 1.0.0-master.d0fcff9, 1.0.0-master.d1a11a4, 1.0.0-master.d1b3e16, 1.0.0-master.d1b4a05, 1.0.0-master.d1c84c1, 1.0.0-master.d1c371d, 1.0.0-master.d1cda2a, 1.0.0-master.d1d858c, 1.0.0-master.d2ab8ab, 1.0.0-master.d2b1df9, 1.0.0-master.d2bf7b3, 1.0.0-master.d2d115d, 1.0.0-master.d2eb1ac, 1.0.0-master.d2f4a56, 1.0.0-master.d3a9b3a, 1.0.0-master.d3a73ec, 1.0.0-master.d3a5949, 1.0.0-master.d3a8747, 1.0.0-master.d3aa594, 1.0.0-master.d03b2c4, 1.0.0-master.d3ce31d, 1.0.0-master.d3d1425, 1.0.0-master.d3f9daf, 1.0.0-master.d3fbdfe, 1.0.0-master.d4bdf8c, 1.0.0-master.d4c8fa0, 1.0.0-master.d5a952a, 1.0.0-master.d5ada18, 1.0.0-master.d5af636, 1.0.0-master.d5b1beb, 1.0.0-master.d5d6f6a, 1.0.0-master.d5daaaf, 1.0.0-master.d5daf23, 1.0.0-master.d5e56c1, 1.0.0-master.d5e1217, 1.0.0-master.d5ec151, 1.0.0-master.d6a7f6d, 1.0.0-master.d6a13dc, 1.0.0-master.d6aea45, 1.0.0-master.d6e730d, 1.0.0-master.d7b7a01, 1.0.0-master.d7c23dc, 1.0.0-master.d7e758a, 1.0.0-master.d7ec908, 1.0.0-master.d7f3e88, 1.0.0-master.d7fca5b, 1.0.0-master.d8aa735, 1.0.0-master.d8c3126, 1.0.0-master.d08f662, 1.0.0-master.d09b6f7, 1.0.0-master.d10fb23, 1.0.0-master.d17ebe8, 1.0.0-master.d20fbff, 1.0.0-master.d023b98, 1.0.0-master.d24db95, 1.0.0-master.d28b8aa, 1.0.0-master.d29b313, 1.0.0-master.d33b4ab, 1.0.0-master.d35c47e, 1.0.0-master.d38dbe6, 1.0.0-master.d50e094, 1.0.0-master.d60d89e, 1.0.0-master.d63ece2, 1.0.0-master.d65e83a, 1.0.0-master.d68e5a8, 1.0.0-master.d72dce4, 1.0.0-master.d73cf52, 1.0.0-master.d77a039, 1.0.0-master.d84ab79, 1.0.0-master.d84e7a2, 1.0.0-master.d88a3ae, 1.0.0-master.d88e52c, 1.0.0-master.d158e66, 1.0.0-master.d169b9c, 1.0.0-master.d296f8d, 1.0.0-master.d355eb4, 1.0.0-master.d424adf, 1.0.0-master.d513d6b, 1.0.0-master.d581d77, 1.0.0-master.d585a87, 1.0.0-master.d595dab, 1.0.0-master.d659e61, 1.0.0-master.d717d19, 1.0.0-master.d725ab5, 1.0.0-master.d0747e3, 1.0.0-master.d748a8c, 1.0.0-master.d824a62, 1.0.0-master.d839bfa, 1.0.0-master.d874a00, 1.0.0-master.d887fd7, 1.0.0-master.d1173f3, 1.0.0-master.d1457e3, 1.0.0-master.d5165be, 1.0.0-master.d5648b3, 1.0.0-master.d05923c, 1.0.0-master.d6056e2, 1.0.0-master.d6162ae, 1.0.0-master.d6168b9, 1.0.0-master.d006267, 1.0.0-master.d6805e5, 1.0.0-master.d7449b3, 1.0.0-master.d16439e, 1.0.0-master.d18349c, 1.0.0-master.d32803b, 1.0.0-master.d51179b, 1.0.0-master.d62365e, 1.0.0-master.d65075a, 1.0.0-master.d80582d, 1.0.0-master.d82186b, 1.0.0-master.d82847f, 1.0.0-master.d83108d, 1.0.0-master.d181895, 1.0.0-master.d251822, 1.0.0-master.d297601, 1.0.0-master.d308622, 1.0.0-master.d398081, 1.0.0-master.d455801, 1.0.0-master.d465975, 1.0.0-master.d553430, 1.0.0-master.d635040, 1.0.0-master.d647875, 1.0.0-master.d719977, 1.0.0-master.d722433, 1.0.0-master.d787168, 1.0.0-master.d799646, 1.0.0-master.d807141, 1.0.0-master.d863993
All unaffected versions: 0.0.1, 0.1.0, 0.1.1, 1.0.0