Skip to main content
cve.nowby Sazabi
← npm
npmPackage

rsshub

6 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 2 high, 4 medium
Registry
npm

Advisories 6

  • CVE-2024-27927Medium 6.5

    RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4

    Affected: fixed in 1.0.0-master.a429472.

  • CVE-2024-27926Medium 6.1

    RSSHub Cross-site Scripting vulnerability caused by internal media proxy

    Affected: from 1.0.0-master.cbbd829, fixed in 1.0.0-master.d8ca915.

  • CVE-2023-26491Medium 5.4

    RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters

    Affected: fixed in 1.0.0-master.c910c4d.

  • RSSHub is vulnerable to SSRF (Server-Side Request Forgery)

    Affected: fixed in 1.0.0-master.a66cbcf.

  • CVE-2022-31110Medium 5.3

    Denial of Service (DoS) vulnerability in RSSHub

    Affected: through 1.0.0.

  • Risk of code injection in RSSHub

    Affected: through 1.0.0.