https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 05:04:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-22089 EUVD-2026-22089 https://cve.radiocsirt.org/vuln/euvd-2026-22089 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21278 <p>RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint.</p> <p>RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-21278 https://cve.radiocsirt.org/vuln/ghsa-pgjj-866w-fc5c <p><strong>Affected:</strong> npm: rsshub</p> <p>### Impact Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues</p> <p>### Patches Temporarily removed the problematic route and added a `no-new-func` rule to eslint Self-built users should upgrade to 7f1c430 and later as soon as possible</p> <p>### Credits Tencent Woodpecker Security Team</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [https://github.com/DIYgod/RSSHub/issues](https://github.com/DIYgod/RSSHub/issues) * Email us at [i@diygod.me](mailto:i@diygod.me)</p> <p><strong>Affected:</strong> npm: rsshub</p> <p>### Impact Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues</p> <p>### Patches Temporarily removed the problematic route and added a `no-new-func` rule to eslint Self-built users should upgrade to 7f1c430 and later as soon as possible</p> <p>### Credits Tencent Woodpecker Security Team</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [https://github.com/DIYgod/RSSHub/issues](https://github.com/DIYgod/RSSHub/issues) * Email us at [i@diygod.me](mailto:i@diygod.me)</p> https://cve.radiocsirt.org/vuln/ghsa-pgjj-866w-fc5c https://cve.radiocsirt.org/vuln/gsd-2021-21278 gsd-2021-21278 https://cve.radiocsirt.org/vuln/gsd-2021-21278