Risk of code injection

Description

Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side security issues

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.0

References

• GHSA-pgjj-866w-fc5c
• www.npmjs.com
• CVE-2021-21278
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Lobe Chat API Key Leak - CVE-2024-37895
• RSSHub Cross-site Scripting vulnerability caused by internal media proxy - CVE-2024-27926
• Denial of Service (DoS) vulnerability in RSSHub - CVE-2022-31110
• Denial of Service in ws - Vulnerability

Tags:

npm

rsshub