{"id":"CVE-2026-111687","published":"2026-10-16T18:17:51.920","lastModified":"2026-10-16T20:17:22.260","description":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-95"],"vendors":[],"products":[],"references":[{"url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/rss.py#L185-L198","tags":[]},{"url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/core/lax/template_parser.py#L1150-L1166","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce","tags":[]},{"url":"https://www.vulncheck.com/advisories/werss-we-mp-rss-through-1.5.3-rce-via-template-parameter-in-rss-endpoint","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce","tags":[]}],"exploitRefs":[{"url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/rss.py#L185-L198","tags":[]},{"url":"https://github.com/rachelos/we-mp-rss/blob/v1.5.3/core/lax/template_parser.py#L1150-L1166","tags":[]}],"hasPoc":true,"ai":{"summary":"WeRSS through version 1.5.3 has a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands via template parameter manipulation. This flaw is particularly dangerous because it can be exploited without any authentication and can run code as the service account.","exploitability":"The exploit is highly straightforward with no authentication required, allowing attackers to execute OS commands through crafted template expressions in the RSS feed endpoint.","blast_radius":"If exploited, this vulnerability could allow attackers to fully compromise the WeRSS service and potentially access all systems that the service account has access to, including other network resources or data stores.","remediation":"Upgrade to version 1.5.4 or later to fix this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","template-injection"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:46:44.381Z"}}