RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2021-01-26T20:25:15
Updated: 2024-08-03T18:09:15.121Z
Reserved: 2020-12-22T00:00:00
Link: CVE-2021-21278
Vulnrichment
No data.
NVD
Status : Modified
Published: 2021-01-26T21:15:12.673
Modified: 2024-11-21T05:47:55.097
Link: CVE-2021-21278
Redhat
No data.