Headline
GHSA-2wqw-hr4f-xrhh: RSSHub Cross-site Scripting vulnerability caused by internal media proxy
Impact
When the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code.
Users who access the deliberately constructed URL are affected.
Patches
This vulnerability was fixed in version https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87. Please upgrade to this or a later version.
Workarounds
No.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-27926
RSSHub Cross-site Scripting vulnerability caused by internal media proxy
Moderate severity GitHub Reviewed Published Mar 5, 2024 in DIYgod/RSSHub
Affected versions
>= 1.0.0-master.cbbd829, < 1.0.0-master.d8ca915
Patched versions
1.0.0-master.d8ca915
Impact
When the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code.
Users who access the deliberately constructed URL are affected.
Patches
This vulnerability was fixed in version DIYgod/RSSHub@4d3e5d7. Please upgrade to this or a later version.
Workarounds
No.
References
- GHSA-2wqw-hr4f-xrhh
- DIYgod/RSSHub@4d3e5d7
Published to the GitHub Advisory Database
Mar 6, 2024