WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution flaw that can be triggered by unauthenticated attackers. The vulnerability arises from the template parameter in the public GET /rss/{feed_id} endpoint. Attackers may provide a non-built‑in ext value and a {{=expression}} template that bypasses the eval denial list via object‑subclass traversal, allowing arbitrary OS commands to be executed with the service account’s privileges.

The affected product is the rachelos we-mp-rss web service, specifically version 1.5.3 and earlier releases that have not incorporated the fix. No other versions or additional vendors are listed in the CNA data.

The CVSS score of 9.3 classifies this as a critical flaw. The EPSS score is 1%, indicating a very low but nonzero exploitation probability. The absence of KEV listing does not mitigate the risk; the flaw is directly exploitable through an unauthenticated, public URL. Attackers can trigger the exploit by issuing a crafted GET request to /rss with a malicious template, resulting in execution of arbitrary shell commands under the service account.