CVE-2026-111687 Details
Description
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.
A remote code execution vulnerability has been identified in WeRSS (we-mp-rss) versions through 1.5.3. This vulnerability allows unauthenticated attackers to execute arbitrary code by exploiting the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can provide a non-built-in ext value and a template expression that bypasses the evaluation denylist, ultimately executing operating system commands as the service account.
Remove the client-supplied template parameter from the public RSS route or require authentication for it. Additionally, harden the template parser to prevent access to Python builtins, and restore authentication on all RSS template rendering.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/rss.py#L185-L198 | [email protected] | Source CodeVendor |
| https://github.com/rachelos/we-mp-rss/blob/v1.5.3/core/lax/template_parser.py#L1150-L1166 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/werss-we-mp-rss-through-1.5.3-rce-via-template-parameter-in-rss-endpoint | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WeRSS | <= 1.5.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |