TI-2022-13154 Aliases CVE-2022-31110 GHSA-jvxx-v45p-v5vf

Denial of Service (DoS) vulnerability in RSSHub

HIGH 72CWE-400Published 2022-06-29 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and RSSHub services which may lead to a denial of service. This issue has been fixed in commit 5c4177441417 and all users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01599 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
DIYgod	RSSHub	commits prior to 5c4177441417b44a6e45c3c63e9eac2504abeb5b	—	No fix listed	CNA
—	rsshub (npm)	up to 1.0.0	—	No fix listed	GHSA-jvxx-v45p-v5vf

RSSHub VendorDIYgod Affected commits prior to 5c4177441417b44a6e45c3c63e9eac2504abeb5b Fixed in — No fix listed CNA
rsshub (npm) Vendor— Affected up to 1.0.0 Fixed in — No fix listed GHSA-jvxx-v45p-v5vf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:rsshub:rsshub::::::node.js::*	before 2022-06-21	Vulnerable	DIYgod

cpe:2.3:a:rsshub:rsshub:*:*:*:*:*:node.js:*:* Versions before 2022-06-21 Vulnerable ·DIYgod

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-31110
2026-10-03 Alias added: GHSA-jvxx-v45p-v5vf

References

Exploit 1

https://github.com/DIYgod/RSSHub/issues/10045

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-31110

Other 2

TI-2023-08742 RSSHub is vulnerable to SSRF (Server-Side Request Forgery) CVSS 3.1HIGH 8.8
TI-2021-04378 Risk of code injection in RSSHub CVSS 3.1CRITICAL 9.8
TI-2024-18530 RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4 CVSS 3.1MEDIUM 6.5
TI-2024-18529 RSSHub Cross-site Scripting vulnerability caused by internal media proxy CVSS 3.1MEDIUM 6.1
TI-2023-11638 RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences