Is CVE-2024-27926 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-27926 being exploited in the wild.

How severe is CVE-2024-27926?

Low severity, with a CVSS score of 3.1, published 6 March 2024.

Which products and versions are affected?

rsshub (npm) SEMVER:introduced=1.0.0-master.cbbd829,fixed=1.0.0-master.d8ca915.

Is there a fix for CVE-2024-27926?

Yes. rsshub (npm): upgrade to 1.0.0-master.d8ca915 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-27926 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2024-27926?

Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-27926: DIYgod RSSHub XSS in internal media proxy

CVE-2024-27926 · Severity: low · CVSS 3.1 · Published 2024-03-06

RSSHub, an open-source tool used to generate RSS feeds from various websites, contains a security vulnerability in its internal media proxy. An attacker can create a malicious link that, when clicked by a user, executes unauthorized scripts in the user's browser. This could lead to the theft of session information or unauthorized actions being performed on behalf of the user.

Technologies: rsshub (npm). Vendors: npm.

Quick answers

Is CVE-2024-27926 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-27926 being exploited in the wild.
How severe is CVE-2024-27926?: Low severity, with a CVSS score of 3.1, published 6 March 2024.
Which products and versions are affected?: rsshub (npm) SEMVER:introduced=1.0.0-master.cbbd829,fixed=1.0.0-master.d8ca915.
Is there a fix for CVE-2024-27926?: Yes. rsshub (npm): upgrade to 1.0.0-master.d8ca915 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-27926 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2024-27926?: Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rsshub (npm): upgrade to 1.0.0-master.d8ca915 or later
```
npm install rsshub@1.0.0-master.d8ca915
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in RSSHub's internal media proxy. The component fails to properly validate or sanitize content when proxying specially crafted images, allowing an attacker to inject and execute arbitrary JavaScript code in the context of the RSSHub domain. The attack is delivered via a network request to a maliciously constructed URL and requires a user to interact with that URL. The vulnerability was addressed by removing the internal media proxy feature in version 1.0.0-master.d8ca915 (commit 4d3e5d7).

Affected products

DIYgod RSSHub >= 1.0.0-master.cbbd829, < 1.0.0-master.d8ca915

Identifiers

CVE-2024-27926
GHSA-2wqw-hr4f-xrhh

Timeline

2024-03-05: advisory: Vendor advisory published on GitHub
2024-03-06: disclosed: Public disclosure via GHSA
2024-03-21: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.