What is GHSA-32gr-4cq6-5w5q?

GHSA-32gr-4cq6-5w5q is a security advisory published by GitHub Security Advisories with Medium severity. rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters

Which CVE IDs does GHSA-32gr-4cq6-5w5q cover?

GHSA-32gr-4cq6-5w5q covers the following CVE IDs: CVE-2023-26491. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-32gr-4cq6-5w5q?

GHSA-32gr-4cq6-5w5q has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-32gr-4cq6-5w5q?

GHSA-32gr-4cq6-5w5q affects 1 product, including: npm/rsshub:\u003c 1.0.0-master.c910c4d.

GHSA-32gr-4cq6-5w5qMediumCVSS 6.1

rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters

Vendor

GitHub Security Advisories

Published

March 1, 2023

Last Modified

March 13, 2023

🔗 CVE IDs covered (1)

CVE-2023-26491 →

📋 Description

Impact

When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code.

Users who access the deliberately constructed URL are affected.

Patches

This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version.

Workarounds

No.

🎯 Affected products1

npm/rsshub:< 1.0.0-master.c910c4d

🔗 References (4)

https://github.com/DIYgod/RSSHub/security/advisories/GHSA-32gr-4cq6-5w5q
https://github.com/DIYgod/RSSHub/commit/c910c4d28717fb860fbe064736641f379fab2c91
https://nvd.nist.gov/vuln/detail/CVE-2023-26491
https://github.com/advisories/GHSA-32gr-4cq6-5w5q