Security

SECURITY.md

Security Policy

Supported Version

Latest commits in master branch

Reporting a Vulnerability

If you believe you have found a security vulnerability in RSSHub, please let us know right away, you can open a draft security advisory or email us at i@diygod.me. We will investigate all legitimate reports and do our best to quickly fix the problem.

RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning which may lead to a full repository takeover.
GHSA-9mqc-fm24-h8cw published Sep 26, 2024 by DIYgod

Critical
XSS vulnerability caused by internal media proxy
GHSA-2wqw-hr4f-xrhh published Mar 5, 2024 by DIYgod

Moderate
RSSHub SSRF vulnerabilities in /mastodon, /zjoi, and /m4
GHSA-3p3p-cgj7-vgw3 published Mar 5, 2024 by DIYgod

Moderate
XSS vulnerability caused by unvalidated URL parameters
GHSA-32gr-4cq6-5w5q published Feb 28, 2023 by DIYgod

Moderate
SSRF vulnerability
GHSA-64wp-jh9p-5cg2 published Jan 11, 2023 by DIYgod

High
Denial of Service (DoS) vulnerability
GHSA-jvxx-v45p-v5vf published Jun 22, 2022 by DIYgod

High
Risk of code injection
GHSA-pgjj-866w-fc5c published Jan 26, 2021 by DIYgod

Moderate

Learn more about advisories related to DIYgod/RSSHub in the GitHub Advisory Database

Overview · DIYgod/RSSHub · GitHub

Security: DIYgod/RSSHub

Security

SECURITY.md

Security Policy

Supported Version

Reporting a Vulnerability