# CVE-2024-27926: DIYgod RSSHub XSS in internal media proxy

Source: https://junglewise.ai/threats/cve-2024-27926-diygod-rsshub-xss-in-internal-media-proxy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-03-06. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2024-27926 · Severity: low · CVSS 3.1 · Published 2024-03-06

RSSHub, an open-source tool used to generate RSS feeds from various websites, contains a security vulnerability in its internal media proxy. An attacker can create a malicious link that, when clicked by a user, executes unauthorized scripts in the user's browser. This could lead to the theft of session information or unauthorized actions being performed on behalf of the user.

Technologies: [rsshub (npm)](https://junglewise.ai/threats/technologies/rsshub). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-27926 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-27926 being exploited in the wild.

**How severe is CVE-2024-27926?** Low severity, with a CVSS score of 3.1, published 6 March 2024.

**Which products and versions are affected?** rsshub (npm) SEMVER:introduced=1.0.0-master.cbbd829,fixed=1.0.0-master.d8ca915.

**Is there a fix for CVE-2024-27926?** Yes. rsshub (npm): upgrade to 1.0.0-master.d8ca915 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-27926 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2024-27926?** Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rsshub (npm): upgrade to 1.0.0-master.d8ca915 or later

  ```sh
  npm install rsshub@1.0.0-master.d8ca915
  ```


## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in RSSHub's internal media proxy. The component fails to properly validate or sanitize content when proxying specially crafted images, allowing an attacker to inject and execute arbitrary JavaScript code in the context of the RSSHub domain. The attack is delivered via a network request to a maliciously constructed URL and requires a user to interact with that URL. The vulnerability was addressed by removing the internal media proxy feature in version 1.0.0-master.d8ca915 (commit 4d3e5d7).

## Affected products

- DIYgod RSSHub >= 1.0.0-master.cbbd829, < 1.0.0-master.d8ca915

## Identifiers

- CVE-2024-27926
- GHSA-2wqw-hr4f-xrhh

## Timeline

- 2024-03-05: advisory: Vendor advisory published on GitHub
- 2024-03-06: disclosed: Public disclosure via GHSA
- 2024-03-21: other: NVD publication date

## References

- [https://github.com/DIYgod/RSSHub/security/advisories/GHSA-2wqw-hr4f-xrhh](https://github.com/DIYgod/RSSHub/security/advisories/GHSA-2wqw-hr4f-xrhh)
- [https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87](https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87)
- [https://github.com/DIYgod/RSSHub](https://github.com/DIYgod/RSSHub)

## Related threats

- [RSSHub SSRF in Mastodon, Zjol, and M4 routes](https://junglewise.ai/threats/cve-2024-27927-rsshub-ssrf-in-mastodon-zjol-and-m4-routes)
- [DIYgod RSSHub cross-site scripting in brief parameter](https://junglewise.ai/threats/cve-2023-26491-diygod-rsshub-cross-site-scripting-in-brief-parameter)
- [RSSHub server-side request forgery](https://junglewise.ai/threats/cve-2023-22493-rsshub-server-side-request-forgery)
- [RSSHub denial of service in filter parameters](https://junglewise.ai/threats/cve-2022-31110-rsshub-denial-of-service-in-filter-parameters)
- [RSSHub code injection via eval and Function constructor](https://junglewise.ai/threats/cve-2021-21278-rsshub-code-injection-via-eval-and-function-constructor)