TI-2024-18530 Aliases CVE-2024-27927 GHSA-3p3p-cgj7-vgw3

RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4

LOW 37CWE-918Published 2024-03-06 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks. The attacker can send malicious requests to a RSSHub server, to make the server send HTTP GET requests to arbitrary destinations and see partial responses. This may lead to leak the server IP address, which could be hidden behind a CDN; retrieving information in the internal network, e.g. which addresses/ports are accessible, the titles and meta descriptions of HTML pages; and denial of service amplification. The attacker could request the server to download some large files, or chain several SSRF requests in a single attacker request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01044 64th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed RSSHub (DIYgod): 1.0.0-master.a429472rsshub (npm): 1.0.0-master.a429472

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
DIYgod	RSSHub	before 1.0.0-master.a429472	1.0.0-master.a429472	Patch available	CNA
—	rsshub (npm)	before 1.0.0-master.a429472	1.0.0-master.a429472	Patch available	GHSA-3p3p-cgj7-vgw3

RSSHub VendorDIYgod Affected before 1.0.0-master.a429472 Fixed in 1.0.0-master.a429472 Patch available CNA
rsshub (npm) Vendor— Affected before 1.0.0-master.a429472 Fixed in 1.0.0-master.a429472 Patch available GHSA-3p3p-cgj7-vgw3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:rsshub:rsshub::::::node.js::*	before 1.0.0-master.a429472	Vulnerable	DIYgod

cpe:2.3:a:rsshub:rsshub:*:*:*:*:*:node.js:*:* Versions before 1.0.0-master.a429472 Vulnerable ·DIYgod

Remediation

Fix · CNA RSSHub (DIYgod) Fixed in 1.0.0-master.a429472
Fix · GHSA-3p3p-cgj7-vgw3 rsshub (npm) Fixed in 1.0.0-master.a429472 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-27927
2026-10-03 Alias added: GHSA-3p3p-cgj7-vgw3

References

Exploit 1

https://github.com/DIYgod/RSSHub/security/advisories/GHSA-3p3p-cgj7-vgw3

Patch 5

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-27927

Other 1

https://github.com/DIYgod/RSSHub

TI-2022-13154 Denial of Service (DoS) vulnerability in RSSHub CVSS 3.1HIGH 7.5
TI-2023-08742 RSSHub is vulnerable to SSRF (Server-Side Request Forgery) CVSS 3.1HIGH 8.8
TI-2021-04378 Risk of code injection in RSSHub CVSS 3.1CRITICAL 9.8
TI-2024-18529 RSSHub Cross-site Scripting vulnerability caused by internal media proxy CVSS 3.1MEDIUM 6.1
TI-2023-11638 RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences