https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T05:04:39.821507+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-22089 EUVD-2026-22089 2026-10-19T05:04:39.825379+00:00 EUVD-2026-22089 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21278 fkie_cve-2021-21278 2026-10-19T05:04:39.825412+00:00

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint.

 https://cve.radiocsirt.org/vuln/ghsa-pgjj-866w-fc5c GHSA-pgjj-866w-fc5c — Risk of code injection 2026-10-19T05:04:39.825442+00:00

Affected: npm: rsshub

### Impact Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues

### Patches Temporarily removed the problematic route and added a `no-new-func` rule to eslint Self-built users should upgrade to 7f1c430 and later as soon as possible

### Credits Tencent Woodpecker Security Team

### For more information If you have any questions or comments about this advisory: * Open an issue in [https://github.com/DIYgod/RSSHub/issues](https://github.com/DIYgod/RSSHub/issues) * Email us at [i@diygod.me](mailto:i@diygod.me)

 https://cve.radiocsirt.org/vuln/gsd-2021-21278 gsd-2021-21278 2026-10-19T05:04:39.825479+00:00 gsd-2021-21278