{
"id": "GHSA-pgjj-866w-fc5c",
"aliases": [
"CVE-2021-21278"
],
"details": "### Impact\nSome routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues\n\n### Patches\nTemporarily removed the problematic route and added a `no-new-func` rule to eslint\nSelf-built users should upgrade to 7f1c430 and later as soon as possible\n\n### Credits\nTencent Woodpecker Security Team\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [https://github.com/DIYgod/RSSHub/issues](https://github.com/DIYgod/RSSHub/issues)\n* Email us at [[email protected] ](mailto:[email protected] )",
"summary": "Risk of code injection",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.0"
}
]
}
],
"package": {
"name": "rsshub",
"ecosystem": "npm"
}
}
],
"modified": "2021-10-11T16:14:26Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
}
],
"published": "2021-10-12T16:03:43Z",
"references": [
{
"url": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-pgjj-866w-fc5c",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21278",
"type": "ADVISORY"
},
{
"url": "https://github.com/DIYgod/RSSHub/commit/7f1c43094e8a82e4d8f036ff7d42568fed00699d",
"type": "WEB"
},
{
"url": "https://github.com/DIYgod/RSSHub",
"type": "PACKAGE"
},
{
"url": "https://www.npmjs.com/package/rsshub",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2021-01-26T21:15:00Z",
"github_reviewed_at": "2021-10-11T16:14:26Z"
}
}