Is CVE-2023-26491 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-26491 being exploited in the wild.

How severe is CVE-2023-26491?

Low severity, with a CVSS score of 3.1, published 1 March 2023.

Which products and versions are affected?

rsshub (npm) SEMVER:introduced=0,fixed=1.0.0-master.c910c4d.

Is there a fix for CVE-2023-26491?

Yes. rsshub (npm): upgrade to 1.0.0-master.c910c4d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-26491 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2023-26491?

Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-26491: DIYgod RSSHub cross-site scripting in brief parameter

CVE-2023-26491 · Severity: low · CVSS 3.1 · Published 2023-03-01

RSSHub is an open-source tool used to generate RSS feeds from various websites. A security flaw exists where the application fails to properly clean up web addresses containing special characters before displaying them on an error page. If a user is tricked into clicking a specially crafted link, an attacker could execute malicious scripts in the user's browser, potentially leading to unauthorized actions or data theft within the context of the RSSHub session.

Technologies: rsshub (npm). Vendors: npm.

Quick answers

Is CVE-2023-26491 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-26491 being exploited in the wild.
How severe is CVE-2023-26491?: Low severity, with a CVSS score of 3.1, published 1 March 2023.
Which products and versions are affected?: rsshub (npm) SEMVER:introduced=0,fixed=1.0.0-master.c910c4d.
Is there a fix for CVE-2023-26491?: Yes. rsshub (npm): upgrade to 1.0.0-master.c910c4d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-26491 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2023-26491?: Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rsshub (npm): upgrade to 1.0.0-master.c910c4d or later
```
npm install rsshub@1.0.0-master.c910c4d
```

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in RSSHub's middleware parameter handling. When a user provides an invalid 'brief' URL parameter containing malicious scripts, the application reflects the unvalidated input directly into an HTML error message. This occurs in 'lib/middleware/parameter.js' where the 'ctx.query.brief' value was previously included in a template string without proper sanitization or encoding. An attacker can exploit this by distributing a crafted URL to victims, executing arbitrary JavaScript in the context of the victim's browser session. The issue was resolved by removing the raw parameter input from the error response.

Affected products

DIYgod RSSHub versions before commit c910c4d28717fb860fbe064736641f379fab2c91

Identifiers

CVE-2023-26491
GHSA-32gr-4cq6-5w5q

Timeline

2023-02-28: advisory: Project maintainer published security advisory
2023-03-01: disclosed: Public disclosure of GHSA-32gr-4cq6-5w5q
2023-03-03: advisory: NVD published CVE-2023-26491

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.