Live › vulnerability › CVE-2026-111687
Go to dashboardwe-mp-rss (WeRSS) up to and including 1.5.3 has an unauthenticated RCE. GET /rss/{feed_id} has its auth dependency commented out, and it passes the 'template' query parameter to a custom template engine. With an unknown 'ext' value (e.g. ext=tpl), a {{=expr}} template is run through Python eval. The substring denylist does not block __class__/__bases__/__subclasses__, so an attacker can reach a process-spawning class and run OS commands as the service account. Output is reflected in the response. No fixed release exists as of 2026-10-23 (latest release is v1.5.3). The same release also has CVE-2026-110617, a missing-auth export download.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| we-mp-rss | github | <= 1.5.3 | – |
1.5.3 and earlier are vulnerablev1.5.3); watch rachelos/we-mp-rss releasestemplate query parameter at a reverse proxy (or deny /rss/ requests containing template= or {{); put the instance behind VPN or auth; run it as an unprivileged user in a container with no secretsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.
This page as .md · .json · in your agent: get_signal("CVE-2026-111687")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.