# CVE-2023-26491: DIYgod RSSHub cross-site scripting in brief parameter

Source: https://junglewise.ai/threats/cve-2023-26491-diygod-rsshub-cross-site-scripting-in-brief-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-01. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2023-26491 · Severity: low · CVSS 3.1 · Published 2023-03-01

RSSHub is an open-source tool used to generate RSS feeds from various websites. A security flaw exists where the application fails to properly clean up web addresses containing special characters before displaying them on an error page. If a user is tricked into clicking a specially crafted link, an attacker could execute malicious scripts in the user's browser, potentially leading to unauthorized actions or data theft within the context of the RSSHub session.

Technologies: [rsshub (npm)](https://junglewise.ai/threats/technologies/rsshub). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-26491 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-26491 being exploited in the wild.

**How severe is CVE-2023-26491?** Low severity, with a CVSS score of 3.1, published 1 March 2023.

**Which products and versions are affected?** rsshub (npm) SEMVER:introduced=0,fixed=1.0.0-master.c910c4d.

**Is there a fix for CVE-2023-26491?** Yes. rsshub (npm): upgrade to 1.0.0-master.c910c4d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-26491 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2023-26491?** Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rsshub (npm): upgrade to 1.0.0-master.c910c4d or later

  ```sh
  npm install rsshub@1.0.0-master.c910c4d
  ```


## Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in RSSHub's middleware parameter handling. When a user provides an invalid 'brief' URL parameter containing malicious scripts, the application reflects the unvalidated input directly into an HTML error message. This occurs in 'lib/middleware/parameter.js' where the 'ctx.query.brief' value was previously included in a template string without proper sanitization or encoding. An attacker can exploit this by distributing a crafted URL to victims, executing arbitrary JavaScript in the context of the victim's browser session. The issue was resolved by removing the raw parameter input from the error response.

## Affected products

- DIYgod RSSHub versions before commit c910c4d28717fb860fbe064736641f379fab2c91

## Identifiers

- CVE-2023-26491
- GHSA-32gr-4cq6-5w5q

## Timeline

- 2023-02-28: advisory: Project maintainer published security advisory
- 2023-03-01: disclosed: Public disclosure of GHSA-32gr-4cq6-5w5q
- 2023-03-03: advisory: NVD published CVE-2023-26491

## References

- [https://github.com/DIYgod/RSSHub/security/advisories/GHSA-32gr-4cq6-5w5q](https://github.com/DIYgod/RSSHub/security/advisories/GHSA-32gr-4cq6-5w5q)
- [https://github.com/DIYgod/RSSHub/commit/c910c4d28717fb860fbe064736641f379fab2c91](https://github.com/DIYgod/RSSHub/commit/c910c4d28717fb860fbe064736641f379fab2c91)
- [https://github.com/DIYgod/RSSHub](https://github.com/DIYgod/RSSHub)

## Related threats

- [RSSHub SSRF in Mastodon, Zjol, and M4 routes](https://junglewise.ai/threats/cve-2024-27927-rsshub-ssrf-in-mastodon-zjol-and-m4-routes)
- [DIYgod RSSHub XSS in internal media proxy](https://junglewise.ai/threats/cve-2024-27926-diygod-rsshub-xss-in-internal-media-proxy)
- [RSSHub server-side request forgery](https://junglewise.ai/threats/cve-2023-22493-rsshub-server-side-request-forgery)
- [RSSHub denial of service in filter parameters](https://junglewise.ai/threats/cve-2022-31110-rsshub-denial-of-service-in-filter-parameters)
- [RSSHub code injection via eval and Function constructor](https://junglewise.ai/threats/cve-2021-21278-rsshub-code-injection-via-eval-and-function-constructor)