CVE-2021-21278

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint.

• CWE-74

• https://github.com/DIYgod/RSSHub/commit/7f1c43094e8a82e4d8f036ff7d42568fed00699dPatch, Third Party Advisory
• https://github.com/DIYgod/RSSHub/security/advisories/GHSA-pgjj-866w-fc5cThird Party Advisory
• https://www.npmjs.com/package/rsshubProduct, Third Party Advisory
• https://github.com/DIYgod/RSSHub/commit/7f1c43094e8a82e4d8f036ff7d42568fed00699dPatch, Third Party Advisory
• https://github.com/DIYgod/RSSHub/security/advisories/GHSA-pgjj-866w-fc5cThird Party Advisory
• https://www.npmjs.com/package/rsshubProduct, Third Party Advisory

Published

Jan 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21272ORAS is open source software which enables a way to push OCI…7.7
• CVE-2021-21273Synapse is a Matrix reference homeserver written in python (…6.1
• CVE-2021-21274Synapse is a Matrix reference homeserver written in python (…6.5
• CVE-2021-21275The MediaWiki "Report" extension has a Cross-Site Request Fo…4.3
• CVE-2021-21276Polr is an open source URL shortener. in Polr before version…9.3
• CVE-2021-21277angular-expressions is "angular's nicest part extracted as a…8.8
• CVE-2021-21279Contiki-NG is an open-source, cross-platform operating syste…7.5
• CVE-2021-2128Vulnerability in the Oracle VM VirtualBox product of Oracle …6.5
• CVE-2021-21280Contiki-NG is an open-source, cross-platform operating syste…9.8
• CVE-2021-21281Contiki-NG is an open-source, cross-platform operating syste…9.8
• CVE-2021-21282Contiki-NG is an open-source, cross-platform operating syste…9.8
• CVE-2021-21283Flarum is an open source discussion platform for websites. T…5.4