TI-2023-08742 Aliases CVE-2023-22493 GHSA-64wp-jh9p-5cg2

RSSHub is vulnerable to SSRF (Server-Side Request Forgery)

HIGH 71CWE-918Published 2023-01-13 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00807 57th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed RSSHub (DIYgod): 1.0.0-master.a66cbcfrsshub (npm): 1.0.0-master.a66cbcf

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
DIYgod	RSSHub	before 1.0.0-master.a66cbcf	1.0.0-master.a66cbcf	Patch available	CNA
—	rsshub (npm)	before 1.0.0-master.a66cbcf	1.0.0-master.a66cbcf	Patch available	GHSA-64wp-jh9p-5cg2

RSSHub VendorDIYgod Affected before 1.0.0-master.a66cbcf Fixed in 1.0.0-master.a66cbcf Patch available CNA
rsshub (npm) Vendor— Affected before 1.0.0-master.a66cbcf Fixed in 1.0.0-master.a66cbcf Patch available GHSA-64wp-jh9p-5cg2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:rsshub:rsshub::::::node.js::*	before 2023-01-10	Vulnerable	DIYgod

cpe:2.3:a:rsshub:rsshub:*:*:*:*:*:node.js:*:* Versions before 2023-01-10 Vulnerable ·DIYgod

Remediation

Fix · CNA RSSHub (DIYgod) Fixed in 1.0.0-master.a66cbcf
Fix · GHSA-64wp-jh9p-5cg2 rsshub (npm) Fixed in 1.0.0-master.a66cbcf Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-22493
2026-10-03 Alias added: GHSA-64wp-jh9p-5cg2

References

Exploit 1

https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-22493

Other 2

TI-2022-13154 Denial of Service (DoS) vulnerability in RSSHub CVSS 3.1HIGH 7.5
TI-2021-04378 Risk of code injection in RSSHub CVSS 3.1CRITICAL 9.8
TI-2024-18530 RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4 CVSS 3.1MEDIUM 6.5
TI-2024-18529 RSSHub Cross-site Scripting vulnerability caused by internal media proxy CVSS 3.1MEDIUM 6.1
TI-2023-11638 RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences