CVE-2021-21278— Risk of code injection in RSSHub
Quick assessment
Affected
DIYgod RSSHub
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RSSHub 存在注入漏洞，该漏洞源于一些路由使用“eval”或“Function constructor”，导致服务器端安全问题。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-21278
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Risk of code injection in RSSHub
Source: CVE Program / CVE List V5
Vulnerability Description
RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
RSSHub 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
RSSHub 存在注入漏洞，该漏洞源于一些路由使用“eval”或“Function constructor”，导致服务器端安全问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-21278
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-21278
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-21278 (1)
Vendor Advisories for CVE-2021-21278 (1)
-
https://github.com/DIYgod/RSSHub/security/advisories/GHSA-pgjj-866w-fc5c x_refsource_CONFIRM
Other References for CVE-2021-21278 (1)
-
https://www.npmjs.com/package/rsshub x_refsource_MISC
IV. Related Vulnerabilities
Same product: RSSHub
-
CVE-2024-47179
RSSHub's `docker-test-cont.yml` workflow is vulnerable to Ar -
CVE-2024-27927
RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4 -
CVE-2024-27926
RSSHub Cross-site Scripting vulnerability caused by internal -
CVE-2023-26491
RSSHub is vulnerable to cross-site scripting (XSS) via unval -
CVE-2023-22493
RSSHub is vulnerable to SSRF (Server-Side Request Forgery)
Same vendor: DIYgod
-
CVE-2024-47179
RSSHub's `docker-test-cont.yml` workflow is vulnerable to Ar -
CVE-2024-27927
RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4 -
CVE-2024-27926
RSSHub Cross-site Scripting vulnerability caused by internal -
CVE-2023-26491
RSSHub is vulnerable to cross-site scripting (XSS) via unval -
CVE-2023-22493
RSSHub is vulnerable to SSRF (Server-Side Request Forgery)
Same weakness: CWE-74
-
CVE-2026-88038
cookies vulnerable to Set-Cookie attribute injection via unv -
CVE-2026-87572
Google Chrome 输入验证错误漏洞 -
CVE-2026-65669
Microsoft SQL Server Elevation of Privilege Vulnerability -
CVE-2026-86252
h3 before 1.15.9 SSE Event Injection via Carriage Return -
CVE-2026-77353
Wallos: iCalendar Injection via CRLF in Subscription Name/No
V. Comments for CVE-2021-21278
No comments yet