Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2023-22493 EUVD-2023-0351GHSA-64wp-jh9p-5cg2

RSSHub is vulnerable to SSRF (Server-Side Request Forgery)

Published Jan 13, 2023 · Updated Mar 10, 2025 · Assigned by GitHub_M

Vendor: DIYgod Product: RSSHub Package: rsshub Ecosystem: npm

Description

RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf.

Affected products

VendorProductAffectedFixed
DIYgod RSSHub < 1.0.0-master.a66cbcf —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm rsshub < 1.0.0-master.a66cbcf 1.0.0-master.a66cbcf GHSA-64wp-jh9p-5cg2

References