high8.6
CVE-2021-21278
Risk of code injection
Impact
### Impact Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues ### Patches Temporarily removed the problematic route and added a `no-new-func` rule to eslint Self-built users should upgrade to 7f1c430 and later as soon as possible ### Credits Tencent Woodpecker Security Team ### For more information If you have any questions or comments about this advisory: * Open an issue in [https://github.com/DIYgod/RSSHub/issues](https://github.com/DIYgod/RSSHub/issues) * Email us at [i@diygod.me](mailto:i@diygod.me)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | rsshub | <= 1.0.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rsshub | Rsshub | before 2021-01-25 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/DIYgod/RSSHub/commit/7f1c43094e8a82e4d8f036ff7d42568fed00699d
- https://github.com/DIYgod/RSSHub/security/advisories/GHSA-pgjj-866w-fc5c
- https://www.npmjs.com/package/rsshub
- https://github.com/advisories/GHSA-pgjj-866w-fc5c
- https://nvd.nist.gov/vuln/detail/CVE-2021-21278