# CVE-2023-22493: RSSHub server-side request forgery

Source: https://junglewise.ai/threats/cve-2023-22493-rsshub-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-01-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-22493 · Severity: low · CVSS 3.1 · Published 2023-01-11

RSSHub is a popular RSS aggregation service that fetches and transforms content feeds from various websites. An attacker can exploit a server-side request forgery (SSRF) vulnerability to trick the RSSHub server into making arbitrary HTTP requests to internal or external servers, potentially exposing sensitive information or enabling further attacks on the infrastructure.

Technologies: [rsshub (npm)](https://junglewise.ai/threats/technologies/rsshub). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-22493 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-22493 being exploited in the wild.

**How severe is CVE-2023-22493?** Low severity, with a CVSS score of 3.1, published 11 January 2023.

**Which products and versions are affected?** rsshub (npm) SEMVER:introduced=0,fixed=1.0.0-master.a66cbcf.

**Is there a fix for CVE-2023-22493?** Yes. rsshub (npm): upgrade to 1.0.0-master.a66cbcf or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-22493 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2023-22493?** Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rsshub (npm): upgrade to 1.0.0-master.a66cbcf or later

  ```sh
  npm install rsshub@1.0.0-master.a66cbcf
  ```


## Technical details

RSSHub contains an SSRF vulnerability (CWE-918) in its route handlers that accept user-supplied URLs. An attacker can craft a malicious URL using URL-encoded characters (e.g., %2F and %23 for / and #) to bypass URL validation logic and modify the base URL from https://${input}.defined.host to https://ATTACKER.HOST/#.defined.host, causing the server to send HTTP requests to an attacker-controlled domain. The vulnerability requires user interaction (a victim visiting a malicious link or form) and is reachable over the network without authentication. An attacker can use this to access internal services, exfiltrate sensitive data, or perform attacks against the server's network. A fix was released in commit a66cbcf (version 1.0.0-master.a66cbcf).

## Affected products

- DIYgod RSSHub before commit a66cbcf

## Identifiers

- CVE-2023-22493
- GHSA-64wp-jh9p-5cg2

## Timeline

- 2023-01-11: disclosed
- 2023-01-11: patched: Fix released in commit a66cbcf

## References

- [https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2](https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2)

## Related threats

- [RSSHub SSRF in Mastodon, Zjol, and M4 routes](https://junglewise.ai/threats/cve-2024-27927-rsshub-ssrf-in-mastodon-zjol-and-m4-routes)
- [DIYgod RSSHub XSS in internal media proxy](https://junglewise.ai/threats/cve-2024-27926-diygod-rsshub-xss-in-internal-media-proxy)
- [DIYgod RSSHub cross-site scripting in brief parameter](https://junglewise.ai/threats/cve-2023-26491-diygod-rsshub-cross-site-scripting-in-brief-parameter)
- [RSSHub denial of service in filter parameters](https://junglewise.ai/threats/cve-2022-31110-rsshub-denial-of-service-in-filter-parameters)
- [RSSHub code injection via eval and Function constructor](https://junglewise.ai/threats/cve-2021-21278-rsshub-code-injection-via-eval-and-function-constructor)