SZB-3f5f66c3aa
PinePods podcast subscription flaw listed by EUVD with CVSS 9.1
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- madeofpendletonwool
- Product
- PinePods
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-114370, updated October 30, 2026, says that before PinePods 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through the add_podcast API endpoint. The listing scores it 9.1 out of 10 under CVSS v3.1.
If you use madeofpendletonwool
Upgrade PinePods to version 0.9.0 or later
Review user accounts and podcast subscriptions for unfamiliar feeds
Limit account registration on public PinePods instances
What the sources say 1
· Mastodon: “Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`.” Source