{"id":"CVE-2026-111687","kind":"vulnerability","aliases":["CVE-2026-111687"],"related":[],"title":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers…","description":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.","summary":"we-mp-rss (WeRSS) up to and including 1.5.3 has an unauthenticated RCE. GET /rss/{feed_id} has its auth dependency commented out, and it passes the 'template' query parameter to a custom template engine. With an unknown 'ext' value (e.g. ext=tpl), a {{=expr}} template is run through Python eval. The substring denylist does not block __class__/__bases__/__subclasses__, so an attacker can reach a process-spawning class and run OS commands as the service account. Output is reflected in the response. No fixed release exists as of 2026-10-23 (latest release is v1.5.3). The same release also has CVE-2026-110617, a missing-auth export download.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"we-mp-rss","fixed":[],"affected":"<= 1.5.3","ecosystem":"github"}],"ecosystems":[],"tags":["fastapi","internet-exposed","other","python","rce","self-hosted","unauthenticated","we-mp-rss"],"not_affected_if":["no-public-rss-endpoint","not-internet-exposed","reverse-proxy-blocks-template-param"],"how_to_check":"Check the version: docker image tag rachelos/we-mp-rss or the release you deployed; 1.5.3 and earlier are vulnerable. Safe probe on your own instance: GET /rss/all?ext=tpl&template=m_{{=7*7}}_m. If the body contains m_49_m, you are exposed. Review your access logs for requests to /rss/ with template= or ext= values other than rss/xml/atom/md/txt/json/jmd, especially containing __subclasses__.","fix":"No patched version published as of 2026-10-23 (latest is v1.5.3); watch rachelos/we-mp-rss releases. Until then: do not expose the service to the internet; block or strip the 'template' query parameter at a reverse proxy (or deny /rss/ requests containing 'template=' or '{{'); put the instance behind VPN or auth; run it as an unprivileged user in a container with no secrets. If it was exposed, assume the host is compromised and rotate any credentials it holds.","status":"open","published_at":"2026-10-16T18:17:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:05:03+00:00","updated_at":"2026-10-23T23:29:48+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:05:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"WeRSS (we-mp-rss) through 1.5.3 has a remote code execution flaw in the public GET /rss/{feed_id} endpoint's template parameter. An unauthenticated attacker can run OS commands as the service account by supplying a crafted template expression that bypasses the eval denylist.","category":"other","who_cares":["we-mp-rss","self-hosted","internet-exposed"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs OS commands as the service account over the internet","analyst_note":"Find the patched version or fixed release after 1.5.3 and whether the template parameter is reachable in the default config, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-111687 and the project's repository.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-public-rss-endpoint"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000781,"input_tokens":2796,"output_tokens":1003,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the patched version or fixed release after 1.5.3 and whether the template parameter is reachable in the default config, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-111687 and the project's repository.","search":"'-10':134B '-110617':147B '-111687':20A,23A '-2026':19A,22A,146B '-23':135B '/__bases__/__subclasses__':102B '/rss':58B,182C '1.5.3':7A,52B,160C '2026':133B 'account':120B,216C 'allow':15A,168C 'also':143B 'attack':17A,105B,170C,186C 'auth':63B,151B 'block':100B 'built':192C 'bypass':205C 'class':101B,112B 'code':11A,164C,173C 'command':116B,212C 'comment':65B 'contain':8A,161C 'custom':76B 'cve':18A,21A,145B 'denylist':97B,208C 'depend':64B 'download':153B 'e.g':84B 'endpoint':185C 'engin':78B 'eval':94B,207C 'execut':12A,165C 'exist':130B 'export':152B 'expos':31B 'expr':88B 'express':198C 'ext':82B,85B,194C 'fastapi':28B 'feed':59B,183C 'fix':128B 'get':57B,181C 'host':37B 'id':60B,184C 'includ':51B 'internet':30B 'internet-expos':29B 'latest':136B 'miss':150B 'missing-auth':149B 'mp':4A,26A,41B,45B,157C 'non':191C 'non-built-in':190C 'object':202C 'object-subclass':201C 'os':115B,211C 'output':121B 'paramet':73B,177C 'pass':69B 'process':110B 'process-spawn':109B 'public':180C 'python':33B,93B 'queri':72B 'rce':34B,56B 'reach':107B 'reflect':123B 'releas':129B,137B,142B 'remot':10A,163C 'respons':126B 'rss':5A,27A,42B,46B,158C 'run':91B,114B,172C,210C 'self':36B 'self-host':35B 'servic':119B,215C 'spawn':111B 'subclass':203C 'substr':96B 'suppli':188C 'templat':71B,77B,89B,176C,199C 'tpl':86B 'travers':204C 'unauthent':16A,38B,55B,169C 'unknown':81B 'v1.5.3':139B 'valu':83B,195C 'via':174C 'vulner':13A,166C 'we':25A 'we-mp-rss':2A,24A,39B,43B,155C 'werss':1A,47B,154C 'whose':200C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-111687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111687","severity":null,"published_at":"2026-10-16T18:17:51+00:00","modified_at":"2026-10-16T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111687:455","url":null,"severity":null,"published_at":"2026-10-23T23:29:48+00:00","modified_at":"2026-10-23T23:29:48+00:00","first_seen_at":"2026-10-23T23:29:48+00:00","fetched_at":"2026-10-23T23:29:48+00:00","note":"Primary writeup (hackmd, static review of v1.5.3) and VulnCheck read; GitHub releases page shows v1.5.3 (13 Aug) as latest, no fixed release found. Route has auth commented out, so default config is reachable. Public PoC/repro on exploit-intel; no KEV, no in-the-wild report found. Social search not done."}],"documents":[{"id":1995,"url":"https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce","title":"WeRSS unauthenticated SSTI to RCE via RSS template parameter (hieuPenguinnn)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1996,"url":"https://www.vulncheck.com/advisories/werss-we-mp-rss-through-1.5.3-rce-via-template-parameter-in-rss-endpoint","title":"VulnCheck: WeRSS through 1.5.3 RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1997,"url":"https://exploit-intel.com/exploit/3653382032018099","title":"Docker Compose repro and PoC for CVE-2026-111687","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1998,"url":"https://github.com/rachelos/we-mp-rss/releases","title":"we-mp-rss releases (latest v1.5.3)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}